> ## Documentation Index
> Fetch the complete documentation index at: https://docs.porcia.org/llms.txt
> Use this file to discover all available pages before exploring further.
# Connect Microsoft Entra ID
> Step-by-step guide to connect Microsoft Entra ID (Azure AD) for SSO discovery
# Connect Microsoft Entra ID to Porcia
Connect your Microsoft Entra ID (formerly Azure AD) to automatically discover all applications your team accesses via Microsoft SSO.
## Prerequisites
* Microsoft Entra ID (Azure AD) tenant
* Global Administrator privileges
* 5-10 minutes for setup
You need Global Administrator access to grant the necessary permissions. If you don't have admin access, ask your IT administrator to set this up.
## What Porcia Will Discover
Once connected, Porcia will discover:
All enterprise applications configured in Entra ID
Custom applications and API integrations
Which team members have access to each application
Login frequency and usage analytics
## Step-by-Step Setup
Go to **Settings → Integrations → SSO** in your Porcia dashboard
Click the **Connect Microsoft Entra** button
A privacy notice will appear explaining exactly what data Porcia collects (app names, user principal names, sign-in timestamps, app permissions). You must check two acknowledgement boxes and click **Accept & Continue** to proceed.
You'll be redirected to Microsoft's sign-in page. **Important:** Sign in with your Global Administrator account.
Microsoft will show the permissions Porcia is requesting:
**Microsoft Graph API:**
* Read all users' full profiles
* Read directory data
* Read all applications
* Read audit log data
* Read all users' sign-in activity
These permissions allow Porcia to discover applications and track usage.
Click **Accept** to grant Porcia access to your Microsoft Entra ID
You may see a consent screen asking to "Grant admin consent for \[Your Organization]". Click **Accept** to proceed.
You'll be redirected back to Porcia. The initial sync will begin automatically and takes 5-10 minutes.
Porcia will:
* Discover all enterprise applications
* Map user assignments and roles
* Analyze recent sign-in activity
* Match applications to vendor database
Once sync completes, go to your dashboard to see all discovered applications
## Permissions Explained
### What We Can Access
**Directory Data (Read-Only):**
* ✅ User profiles (name, email, department)
* ✅ Group memberships
* ✅ Organizational structure
* ✅ User status and licenses
**Application Data (Read-Only):**
* ✅ Enterprise applications catalog
* ✅ App registrations and configurations
* ✅ User assignments to applications
* ✅ Application roles and permissions
**Activity Data (Read-Only):**
* ✅ Sign-in logs and events
* ✅ Application usage statistics
* ✅ Audit logs for app access
* ✅ Conditional access policy results
### What We CANNOT Do
* ❌ **Modify users** - We never add, remove, or change users
* ❌ **Change app assignments** - We never modify who has access to what
* ❌ **Access user data** - We never read emails, files, or personal data
* ❌ **Modify applications** - We never change app configurations
* ❌ **Create resources** - We never create new apps or users
All permissions are read-only. Porcia cannot make any changes to your Microsoft Entra ID configuration.
## What Gets Discovered
### Enterprise Applications
**Examples of apps Porcia will find:**
* Salesforce
* ServiceNow
* Slack
* Zoom
* Adobe Creative Cloud
* AWS SSO
* Google Workspace (if configured)
**Information extracted:**
* Application name and logo
* Vendor identification
* User assignments and roles
* Sign-in frequency
* Last access date
* Conditional access policies
### App Registrations
**Examples of custom apps:**
* Internal company applications
* Custom API integrations
* Power Platform apps
* Third-party integrations
**Information extracted:**
* Application name and type
* API permissions granted
* User consent status
* Usage frequency
### User Access Patterns
**Analytics Porcia provides:**
* Most used applications by team
* Unused application licenses
* Sign-in frequency distribution
* Failed sign-in attempts
* Conditional access policy impacts
* Shadow IT detection
## Troubleshooting
### Connection Failed
**Error: "AADSTS50105: The signed in user is not assigned to a role for the application"**
* Ensure you're signing in with a Global Administrator account
* Check that the admin account has the necessary privileges
* Try using a different Global Admin account
**Error: "AADSTS65001: The user or administrator has not consented to use the application"**
* Your organization may require admin pre-approval
* Contact your Global Administrator
* They may need to pre-approve Porcia in the Azure portal
**Error: "AADSTS50020: User account from identity provider does not exist in tenant"**
* Ensure you're signing in to the correct tenant
* Check the tenant ID in the URL
* Use the correct organizational account
If your organization requires pre-approval:
1. Go to **Azure Portal → Azure Active Directory → Enterprise applications**
2. Click **New application → Create your own application**
3. Enter "Porcia" as the application name
4. Select **Integrate any other application you don't find in the gallery**
5. Click **Create**
6. Go to **Properties** and set **User assignment required** as needed
7. Go to **Users and groups** to assign users
8. Go to **Permissions** and grant admin consent
After pre-approval, users can connect without additional admin consent.
### No Applications Discovered
**If no applications appear after sync:**
1. **Wait longer** - Large organizations can take 15-20 minutes for initial sync
2. **Check enterprise apps** - Verify your organization has enterprise applications configured
3. **Verify admin permissions** - Ensure the connected account has Global Administrator role
4. **Check API permissions** - Verify all required Graph API permissions are granted
### Sync Stopped Working
**If sync stops after working initially:**
1. **Check connection status** - Go to Settings → Integrations → SSO
2. **Reconnect if needed** - Click **Reconnect** if status shows "Disconnected"
3. **Check token expiration** - OAuth tokens may expire; reconnect to refresh
4. **Check admin account** - Verify the admin account is still active and has permissions
**Need Help?** Check our [FAQ](/troubleshooting/faq) or contact [support@porcia.org](mailto:support@porcia.org) for SSO troubleshooting assistance.
## Azure Portal Management
### Viewing Connected Apps
To see all apps in your Entra ID:
1. Go to **Azure Portal → Azure Active Directory → Enterprise applications**
2. View **All applications**
3. Filter by **Application type** or **Assignment required**
### Managing App Access
To control app access:
1. Go to **Azure Portal → Azure Active Directory → Enterprise applications**
2. Select an application
3. Go to **Users and groups** to manage assignments
4. Go to **Conditional Access** to set access policies
### Sign-in Logs
To view sign-in activity:
1. Go to **Azure Portal → Azure Active Directory → Sign-ins**
2. Filter by **Application**, **User**, or **Date range**
3. View detailed sign-in events and errors
### Audit Logs
To view audit logs:
1. Go to **Azure Portal → Azure Active Directory → Audit logs**
2. Filter by **Service** (Application Management)
3. View application-related changes and events
## Microsoft 365 vs Azure AD
Porcia works with both Microsoft 365 and standalone Azure AD:
| Feature | Microsoft 365 | Azure AD Free | Azure AD Premium |
| ------------------ | ------------- | --------------- | ---------------- |
| Enterprise Apps | ✅ Full access | ✅ Full access | ✅ Full access |
| Sign-in Logs | ✅ 30 days | ❌ Limited | ✅ 30 days |
| Audit Logs | ✅ 90 days | ❌ Limited | ✅ 90 days |
| Conditional Access | ✅ Available | ❌ Not available | ✅ Available |
| Advanced Analytics | ✅ Available | ❌ Limited | ✅ Available |
For best results, use Microsoft 365 or Azure AD Premium which provide full sign-in and audit logs.
## Data Sync Frequency
**Initial Sync:**
* Complete enterprise applications catalog
* All user assignments and roles
* 30 days of sign-in history (if available)
* Audit logs for application changes
**Ongoing Sync:**
* **Applications:** Daily (new apps, configuration changes)
* **User assignments:** Daily (new assignments, role changes)
* **Sign-in data:** Daily (login events, activity)
* **Audit data:** Daily (configuration changes)
You can manually trigger a sync anytime from Settings → Integrations → SSO → Sync Now.
## Privacy & Security
### Data Storage
* **User directory** - Names, emails, departments (encrypted)
* **Application catalog** - App names, logos, configurations
* **Sign-in analytics** - Login events, frequency (anonymized in reports)
* **Access patterns** - User-to-app relationships
### Data Protection
* **Encryption** - AES-256 at rest, TLS 1.3 in transit
* **Access control** - Only workspace admins can view detailed user data
* **Audit logs** - Complete audit trail of all sync activity
* **Token security** - OAuth tokens stored securely with encryption at rest
### Compliance
* **Data privacy** - Right to access, delete, and export data (GDPR compliance in progress)
* **Microsoft Security** - Follows Microsoft's security best practices
* **Zero Trust** - Compatible with Zero Trust security models
**Security:** Porcia follows industry-standard security practices including end-to-end encryption and role-based access control. Full security documentation coming soon.
## Disconnecting Microsoft Entra
To disconnect your Microsoft Entra ID:
1. Go to **Settings → Integrations → SSO**
2. Find Microsoft Entra connection
3. Click **Disconnect**
4. Confirm disconnection
Disconnecting will stop new application discovery and usage tracking. Historical data will be preserved unless you choose to delete it.
### Revoke Access in Azure
To completely revoke Porcia's access:
1. Go to **Azure Portal → Azure Active Directory → Enterprise applications**
2. Find "Porcia" in the applications list
3. Click **Delete** or go to **Properties** and disable
4. Alternatively, go to **App registrations** and delete the registration
## Common Integration Scenarios
### Scenario 1: Hybrid Environment
**Setup:** Using both on-premises AD and Azure AD
* Connect Azure AD to Porcia for cloud applications
* On-premises applications won't be discovered (cloud-only)
* Consider Azure AD Connect for unified identity
### Scenario 2: Multiple Tenants
**Setup:** Multiple Azure AD tenants (e.g., after acquisition)
* Connect each tenant separately to Porcia
* Porcia will show applications from all connected tenants
* Useful for consolidation planning
### Scenario 3: B2B Collaboration
**Setup:** External users accessing your applications
* Porcia discovers applications but filters external users
* Focus on internal user access patterns
* External user activity available in detailed logs
## Next Steps
Add email discovery for complete visibility
Track browser usage
Organize discovered applications
Analyze application usage