Onboard a Microsoft Entra ID App to SSPM

1. Log in to the administrator account that you will use to create your Microsoft Entra application and its associated service principal.

   Required Permissions: The administrator must be able to grant access to the API scopes required by SSPM. In SSPM, the Microsoft Entra onboarding screen lists the scopes that SSPM requires. These scopes are also listed later in these instructions.

   1. Open a web browser to the Microsoft Entra admin center.
   2. Log in to the administrator account.
2. Create and register your Microsoft Entra application.

   1. From the left navigation pane in the Microsoft Entra admin center, select App registrations.
   2. On the App registrations page, select the action to create a New application.
   3. On the Register an Application page, complete the following actions:

      1. Specify a name for the application.
      2. Select Accounts in this organizational directory only.
      3. Register.
         Microsoft Entra registers your application and displays the details page for your application. Registering the application automatically creates its associated service principal.

3. Copy the tenant ID and application credentials (client ID and client secret) for your application.

   1. Copy the tenant ID and client ID.

      1. From the details page for your application, select Overview.
      2. From the overview page, copy the client ID from the Application (client) ID field and paste it into a text file.
      3. From the overview page, copy the tenant ID from the Directory (tenant) ID field and paste it into a text file.

      Don’t continue to the next step unless you have copied the client ID and tenant ID. You will also provide this information to SSPM during the onboarding process.

   2. Create and copy the client secret.

      1. From the details page for your application, select Certificates & secretsClient secrets.
      2. Select New client secret.
      3. In the Add a client secret flyout dialog, specify an expiration date for the client secret and Add the client secret.

      4. Copy the Value of the new client secret and paste it into a text file.
         Don’t continue to the next step unless you have copied the client secret. You will need to provide this information to SSPM during the onboarding process.
4. Configure API permissions for your application.

   Configure your application to enable access only to the Microsoft Graph API scopes that SSPM requires.

   1. From the details page for your application, select API permissions.
   2. On the API permissions page, select the action to Add a permission.
   3. In the Request API permissions flyout dialog, select the Microsoft Graph API.

      The Microsoft Graph page prompts you to select the type of permissions your application requires.
   4. Select Application permissions.

   5. The Microsoft Graph page prompts you to select the type of permissions your application requires.
   6. Select the following API scopes and Add permissions.

      • AuthenticationContext.Read.All
      • IdentityProvider.Read.All
      • Policy.Read.All
      • RoleManagement.Read.Directory
   7. On the API permissions page, verify that all the scopes were added as application permissions.
   8. On the API permissions page, select Grant admin consent for your organization.
5. Connect SSPM to your Microsoft Entra ID instance.

   In SSPM, complete the following steps to enable SSPM to connect to your Microsoft Entra ID instance.

   1. Log in to Strata Cloud Manager.
   2. Select ConfigurationSaaS SecurityPosture SecurityApplicationsAdd Application and click the Microsoft Entra ID tile.
   3. On the Posture Security tab, Add New instance.
   4. Select the option for Service Principal.
   5. Enter the application credentials (client ID and client secret) and your tenant ID.
   6. Connect.