setup

Microsoft Graph (Entra + Intune + O365)

Purpose

Ingests users, groups, service principals, role assignments, managed devices, detected apps, compliance policies, and Office 365 licensing (subscribed SKUs, service plans, and per-user license assignments) from Microsoft Graph. Combine with the azure module for a complete view of identity, application, and device access across your Microsoft estate.

tip

Secret fields below accept either an AWS Secrets Manager ARN or a value pasted directly into SubImage's managed vault. See Secrets for details.

Required Fields

These credentials drive upstream Cartography's canonical --microsoft-* args for Microsoft (Entra ID + Intune + O365) ingestion. The legacy --entra-* args remain accepted as deprecated aliases; the SubImage field names below stay entra_*.

Field Secret? Description
entra_tenant_id No Directory / Tenant ID
entra_client_id No Application (client) ID of a registered app
entra_client_secret Yes Client secret for the registered app

Setup Steps

  1. Register a new App registration in Azure Portal → Entra ID.
  2. Under API permissions, add the following Application permissions and grant admin consent:
    • AdministrativeUnit.Read.All
    • Application.Read.All
    • DeviceManagementApps.Read.All
    • DeviceManagementConfiguration.Read.All
    • DeviceManagementManagedDevices.Read.All
    • Directory.Read.All
    • Group.Read.All
    • GroupMember.Read.All
    • RoleManagement.Read.Directory
    • User.Read.All
  3. Generate a Client Secret under Certificates & secrets.
  4. In SubImage, fill in the fields above (use the client secret or its AWS Secret ARN for entra_client_secret) and save the module.

Authenticates via the OAuth 2.0 client credentials flow.

On this page
PurposeRequired FieldsSetup Steps