Microsoft Entra Integration
Overview
Section titled “Overview”The Microsoft Entra integration connects your Azure AD / Entra tenant to Fencer for identity management and SaaS security scanning. Once connected, Fencer syncs your tenant’s users and groups, evaluates your tenant’s security configuration against CIS benchmarks, and detects misconfigurations such as missing MFA enforcement, excessive Global Administrators, and permissive guest access.
Prerequisites
Section titled “Prerequisites”- A Microsoft Entra account with the Global Reader, User Administrator, or Global Administrator role, able to consent to the requested OAuth scopes.
- Your Entra tenant must allow third-party application access to the Microsoft Graph API.
- A valid Fencer subscription and the Administrator role in your Fencer organization.
How it works
Section titled “How it works”When you connect Microsoft Entra, Fencer initiates an OAuth 2.0 authorization code flow against the
Microsoft identity platform (login.microsoftonline.com). The requested scopes grant read-only
access to users, groups, directory data, policies (including Conditional Access), role management,
user authentication methods, PIM role assignment schedules, and risky users via the Microsoft Graph
API. The last two need an Entra ID P2 license to return data.
After authorization, Fencer stores encrypted OAuth tokens (access and refresh) and associates the connection with your Entra tenant ID. A SaaS account asset is created for the tenant, and two automated workflows are triggered: an identity sync that imports all Entra users, and a SaaS security scan that evaluates your tenant configuration. Both then repeat on a schedule: the security scan runs daily (weekly on plans without daily scans), and the identity sync runs daily when your plan includes identity management. If this is the first integration in your organization that can act as an identity provider, Fencer makes it the primary identity source automatically.
Usage / Configuration
Section titled “Usage / Configuration”Connecting Microsoft Entra
Section titled “Connecting Microsoft Entra”- Navigate to Admin > Integrations in your organization.
- Click the Microsoft Entra card, then click Continue.
- Review the permissions summary and click Connect Microsoft Entra to begin the OAuth flow.
- Sign in with your Microsoft Entra admin account if prompted, and click Accept.
- After authorization, you are redirected back to Fencer. The integration is now active and your tenant appears as a connected SaaS account.
Setting as primary identity source
Section titled “Setting as primary identity source”If Microsoft Entra is your organization’s primary directory, you can designate it as the primary identity source:
- Navigate to Admin > Integrations and find your Microsoft Entra connection.
- Click Edit on the connection.
- Turn on Primary Identity Source and click Save changes.
Reconnecting
Section titled “Reconnecting”To refresh Microsoft tokens or permissions without disconnecting, open the connection’s edit page and click Reconnect.
Disconnecting
Section titled “Disconnecting”To disconnect the integration, click Remove on the connection in Admin > Integrations and confirm. Fencer deletes the stored tokens and removes the connection and its vendor record. To also revoke Fencer’s consent on Microsoft’s side, remove the Fencer enterprise application in the Entra admin center.
Security checks
Section titled “Security checks”Once connected, Fencer runs the following security checks against your Entra tenant:
| Check | Severity | What it detects |
|---|---|---|
| Multi-factor authentication is not enforced | High | Security defaults are disabled, meaning MFA is not required for users by default. |
| Legacy authentication protocols are not blocked | High | No Conditional Access policy blocks legacy protocols (IMAP, SMTP, POP3, older Office clients) that cannot enforce MFA. |
| Users can grant any OAuth app access without admin approval | High | Users can grant any OAuth app access to their mailbox, calendar, and files without admin approval, enabling consent phishing attacks. |
| Phishing-resistant MFA is not enforced | High | SMS-based MFA is enabled with no Conditional Access policy requiring phishing-resistant authentication (FIDO2 or Windows Hello). |
| Identity Protection risk policies are not configured | High | No Conditional Access policy blocks or remediates high-risk sign-ins, and/or users with unresolved high risk scores exist. |
| No properly configured break-glass accounts | High | Fewer than 2 cloud-only Global Admin accounts using the *.onmicrosoft.com domain, risking tenant lockout during MFA or IdP failures. |
| Too many Global Administrators | Medium | More than 4 Global Administrators, exceeding the CIS benchmark recommendation of 2–4. |
| Guest users are present in the tenant | Medium | Guest accounts exist in the tenant and should be reviewed for continued access needs. |
| Guest users have overly permissive directory access | Medium | Guest user permissions allow directory enumeration of users, groups, and applications. |
| No Conditional Access policy requires compliant devices | Medium | No Conditional Access policy requires Intune-compliant or Hybrid Azure AD Joined devices. |
| Global Administrators have permanent role assignments without PIM | Medium | Global Administrators have permanent, always-active role assignments not managed by Privileged Identity Management (PIM). |
Identity sync
Section titled “Identity sync”The integration syncs Microsoft Entra users into Fencer’s identity management system. Each user record includes:
- Email and display name
- Username (userPrincipalName)
- Role (the user’s job title; left blank when none is set)
- Status (active, inactive, or guest)
- Identity type (user or service account — service accounts are detected by an
svc-display name prefix on a*.onmicrosoft.comUPN) - Group memberships
- Account creation date
The sync runs automatically when the integration is first connected, then daily, and you can start it at any time with Sync Identities on Posture > Identities.
Troubleshooting
Section titled “Troubleshooting”- “Failed to fetch Microsoft Entra organization info. Please ensure you have sufficient permissions.” — The authorizing account does not have sufficient permissions. Re-authorize with an account that has access to the Organization endpoint in Microsoft Graph.
- Connecting the same tenant again — Fencer matches the tenant ID and updates the existing connection instead of creating a second one.
- Token refresh failures — If the OAuth refresh token becomes invalid (for example, after revoking consent in the Azure portal), click Reconnect on the connection’s edit page.
- Missing security check results — Some checks (PIM role assignments, risky users) require an Entra ID P2 license. If your tenant is on a lower tier, those checks may return empty results.