​

Connect Microsoft Entra ID to Porcia

Connect your Microsoft Entra ID (formerly Azure AD) to automatically discover all applications your team accesses via Microsoft SSO.

​

Prerequisites

• Microsoft Entra ID (Azure AD) tenant
• Global Administrator privileges
• 5-10 minutes for setup

​

What Porcia Will Discover

Once connected, Porcia will discover:

​

Step-by-Step Setup

​

Permissions Explained

​

What We Can Access

Directory Data (Read-Only):

• ✅ User profiles (name, email, department)
• ✅ Group memberships
• ✅ Organizational structure
• ✅ User status and licenses

Application Data (Read-Only):

• ✅ Enterprise applications catalog
• ✅ App registrations and configurations
• ✅ User assignments to applications
• ✅ Application roles and permissions

Activity Data (Read-Only):

• ✅ Sign-in logs and events
• ✅ Application usage statistics
• ✅ Audit logs for app access
• ✅ Conditional access policy results

​

What We CANNOT Do

• ❌ Modify users - We never add, remove, or change users
• ❌ Change app assignments - We never modify who has access to what
• ❌ Access user data - We never read emails, files, or personal data
• ❌ Modify applications - We never change app configurations
• ❌ Create resources - We never create new apps or users

​

What Gets Discovered

​

Enterprise Applications

Examples of apps Porcia will find:

• Salesforce
• ServiceNow
• Slack
• Zoom
• Adobe Creative Cloud
• AWS SSO
• Google Workspace (if configured)

Information extracted:

• Application name and logo
• Vendor identification
• User assignments and roles
• Sign-in frequency
• Last access date
• Conditional access policies

​

App Registrations

Examples of custom apps:

• Internal company applications
• Custom API integrations
• Power Platform apps
• Third-party integrations

Information extracted:

• Application name and type
• API permissions granted
• User consent status
• Usage frequency

​

User Access Patterns

Analytics Porcia provides:

• Most used applications by team
• Unused application licenses
• Sign-in frequency distribution
• Failed sign-in attempts
• Conditional access policy impacts
• Shadow IT detection

​

Troubleshooting

​

Connection Failed

Error: “AADSTS50105: The signed in user is not assigned to a role for the application”

• Ensure you’re signing in with a Global Administrator account
• Check that the admin account has the necessary privileges
• Try using a different Global Admin account

Error: “AADSTS65001: The user or administrator has not consented to use the application”

• Your organization may require admin pre-approval
• Contact your Global Administrator
• They may need to pre-approve Porcia in the Azure portal

Error: “AADSTS50020: User account from identity provider does not exist in tenant”

• Ensure you’re signing in to the correct tenant
• Check the tenant ID in the URL
• Use the correct organizational account

Pre-approve Porcia in Azure Portal

If your organization requires pre-approval:

1. Go to Azure Portal → Azure Active Directory → Enterprise applications
2. Click New application → Create your own application
3. Enter “Porcia” as the application name
4. Select Integrate any other application you don’t find in the gallery
5. Click Create
6. Go to Properties and set User assignment required as needed
7. Go to Users and groups to assign users
8. Go to Permissions and grant admin consent

After pre-approval, users can connect without additional admin consent.

​

No Applications Discovered

If no applications appear after sync:

1. Wait longer - Large organizations can take 15-20 minutes for initial sync
2. Check enterprise apps - Verify your organization has enterprise applications configured
3. Verify admin permissions - Ensure the connected account has Global Administrator role
4. Check API permissions - Verify all required Graph API permissions are granted

​

Sync Stopped Working

If sync stops after working initially:

1. Check connection status - Go to Settings → Integrations → SSO
2. Reconnect if needed - Click Reconnect if status shows “Disconnected”
3. Check token expiration - OAuth tokens may expire; reconnect to refresh
4. Check admin account - Verify the admin account is still active and has permissions

​

Azure Portal Management

​

Viewing Connected Apps

To see all apps in your Entra ID:

1. Go to Azure Portal → Azure Active Directory → Enterprise applications
2. View All applications
3. Filter by Application type or Assignment required

​

Managing App Access

To control app access:

1. Go to Azure Portal → Azure Active Directory → Enterprise applications
2. Select an application
3. Go to Users and groups to manage assignments
4. Go to Conditional Access to set access policies

​

Sign-in Logs

To view sign-in activity:

1. Go to Azure Portal → Azure Active Directory → Sign-ins
2. Filter by Application, User, or Date range
3. View detailed sign-in events and errors

​

Audit Logs

To view audit logs:

1. Go to Azure Portal → Azure Active Directory → Audit logs
2. Filter by Service (Application Management)
3. View application-related changes and events

​

Microsoft 365 vs Azure AD

Porcia works with both Microsoft 365 and standalone Azure AD:

​

Data Sync Frequency

Initial Sync:

• Complete enterprise applications catalog
• All user assignments and roles
• 30 days of sign-in history (if available)
• Audit logs for application changes

Ongoing Sync:

• Applications: Daily (new apps, configuration changes)
• User assignments: Daily (new assignments, role changes)
• Sign-in data: Daily (login events, activity)
• Audit data: Daily (configuration changes)

​

Privacy & Security

​

Data Storage

• User directory - Names, emails, departments (encrypted)
• Application catalog - App names, logos, configurations
• Sign-in analytics - Login events, frequency (anonymized in reports)
• Access patterns - User-to-app relationships

​

Data Protection

• Encryption - AES-256 at rest, TLS 1.3 in transit
• Access control - Only workspace admins can view detailed user data
• Audit logs - Complete audit trail of all sync activity
• Token security - OAuth tokens stored securely with encryption at rest

​

Compliance

• Data privacy - Right to access, delete, and export data (GDPR compliance in progress)
• Microsoft Security - Follows Microsoft’s security best practices
• Zero Trust - Compatible with Zero Trust security models

​

Disconnecting Microsoft Entra

To disconnect your Microsoft Entra ID:

1. Go to Settings → Integrations → SSO
2. Find Microsoft Entra connection
3. Click Disconnect
4. Confirm disconnection

​

Revoke Access in Azure

To completely revoke Porcia’s access:

1. Go to Azure Portal → Azure Active Directory → Enterprise applications
2. Find “Porcia” in the applications list
3. Click Delete or go to Properties and disable
4. Alternatively, go to App registrations and delete the registration

​

Common Integration Scenarios

​

Scenario 1: Hybrid Environment

Setup: Using both on-premises AD and Azure AD

• Connect Azure AD to Porcia for cloud applications
• On-premises applications won’t be discovered (cloud-only)
• Consider Azure AD Connect for unified identity

​

Scenario 2: Multiple Tenants

Setup: Multiple Azure AD tenants (e.g., after acquisition)

• Connect each tenant separately to Porcia
• Porcia will show applications from all connected tenants
• Useful for consolidation planning

​

Scenario 3: B2B Collaboration

Setup: External users accessing your applications

• Porcia discovers applications but filters external users
• Focus on internal user access patterns
• External user activity available in detailed logs

​

Next Steps