setup

Microsoft Graph (Entra + Intune + O365)

Purpose

Ingests users, groups, service principals, role assignments, managed devices, detected apps, compliance policies, and Office 365 licensing (subscribed SKUs, service plans, and per-user license assignments) from Microsoft Graph. Combine with the azure module for a complete view of identity, application, and device access across your Microsoft estate.

The simplest setup registers no application at all. A tenant administrator grants admin consent to SubImage's multi-tenant Entra application once, and this module needs no credential fields.

Connect Microsoft from Settings > Integrations, then run a sync here. See the Microsoft integration guide for the permissions it requests and the reason for each.

The rest of this page covers registering your own application instead, which is the path to use when your organization does not permit consenting to a vendor multi-tenant application.

tip

Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.

Fields

Leave these empty when Microsoft is connected through admin consent. When set, they take precedence over the integration.

These credentials drive upstream Cartography's canonical --microsoft-* args for Microsoft (Entra ID + Intune + O365) ingestion. The legacy --entra-* args remain accepted as deprecated aliases; the SubImage field names below stay entra_*.

Field Secret? Description
entra_tenant_id No Directory / Tenant ID
entra_client_id No Application (client) ID of a registered app
entra_client_secret Yes Client secret for the registered app

Bring your own application

  1. Register a new App registration in Azure Portal → Entra ID.
  2. Under API permissions, add the following Application permissions and grant admin consent:
    • AdministrativeUnit.Read.All
    • Application.Read.All
    • DeviceManagementApps.Read.All
    • DeviceManagementConfiguration.Read.All
    • DeviceManagementManagedDevices.Read.All
    • Directory.Read.All
    • Group.Read.All
    • GroupMember.Read.All
    • RoleManagement.Read.Directory
    • User.Read.All
  3. Generate a Client Secret under Certificates & secrets.
  4. In SubImage, fill in the fields above (use the client secret or its AWS Secret ARN for entra_client_secret) and save the module.

Authenticates via the OAuth 2.0 client credentials flow.

On this page
PurposeRecommended: connect through admin consentFieldsBring your own application