Microsoft 365 / Entra ID

Connect Microsoft 365 to sync your Entra ID (Azure AD) directory into ConcertoGRC. The integration auto-populates and maintains your personnel directory, detects MFA status, inventories enterprise applications, and generates compliance evidence reports.

What You Get

Personnel Directory

• User sync -- All Entra ID users are synced to AccessPersonnel with name, email, department, job title, and status
• Group sync -- Security groups and distribution lists imported into AccessGroup (only when Groups or the Group Membership package is enabled)
• MFA detection -- Per-user MFA enrollment status tracked automatically
• Admin user identification -- Users with directory or global admin roles are flagged
• Auto-escalation -- Suspended users are automatically escalated to TERMINATED status after a configurable number of days

Enterprise Applications

• App inventory -- Enterprise applications registered in Entra ID are synced to AccessApplication
• Access grants -- App role assignments mapped to SSO assignment records

Evidence Reports (Auto-Generated)

Five compliance reports are automatically generated on each sync cycle when the matching evidence package is enabled:

Report	Description
User Roster	Complete directory listing with department, title, and status
MFA Status	Per-user MFA enrollment with method details
Admin Users	Users with administrative role assignments
Group Membership	Group roster with member counts and nesting
Inactive Users	Users with no sign-in activity beyond a configurable threshold

Setup

One-Click Admin Consent

ConcertoGRC uses Microsoft's admin consent flow for the simplest setup experience.

1. Navigate to Integrations in ConcertoGRC
2. Find the Microsoft 365 card and click Connect
3. Click Grant Admin Consent -- this redirects to Microsoft's consent page
4. Sign in with a Microsoft 365 Global Administrator or Privileged Role Administrator account
5. Review the requested permissions and click Accept
6. You are redirected back to ConcertoGRC with the connection established

Required Permissions (Microsoft Graph API)

All permissions below are Application type (app-only). ConcertoGRC authenticates with a certificate and requests https://graph.microsoft.com/.default. The v1 adminconsent scope query does not add a permission that is missing from the Concerto multi-tenant app registration -- after any Application permission is added on that registration, tenants must re-run admin consent.

These Application permissions match the consent URL in the Integrations wizard:

Application permission	Graph call	Used when
User.Read.All	GET /users	Users, roster, MFA package, admin package, inactive package
Group.Read.All	GET /groups, GET /groups/{id}/members	Groups, group-membership package
UserAuthenticationMethod.Read.All	GET /users/{id}/authentication/methods	Users, MFA package
Application.Read.All	GET /servicePrincipals, GET /servicePrincipals/{id}/appRoleAssignedTo	Enterprise apps
SecurityAlert.Read.All	GET /security/alerts_v2	Defender
SecurityEvents.Read.All	GET /security/alerts (legacy fallback)	Defender, Secure Score

All of these are read scopes. ConcertoGRC does not write to or modify your Entra ID directory.

If a sync is partial or error, the Integrations card shows the Graph call that was denied and the Application permission to grant, then re-consent.

Sync Behavior

• Frequency: Every 24 hours
• User matching: On initial sync, existing AccessPersonnel records are matched by email address to avoid duplicates
• Field sync policy: Each field has a sync policy -- either IdP-managed (overwritten on sync) or local (preserved). Administrators can configure which fields the IdP controls.
• Status mapping: Entra ID account status maps to platform status (Active → ACTIVE, Disabled → SUSPENDED)
• Delta detection: Only changed records are updated on subsequent syncs
• Groups: The groups step runs only when Entra ID Groups or the Group Membership evidence package is enabled. It is not called on a users-only connection.

Disconnecting

Revoking the integration from ConcertoGRC removes the stored credentials. To fully revoke access, also remove the ConcertoGRC enterprise application from your Entra ID admin center (Enterprise Applications → ConcertoGRC → Properties → Delete).

Disconnecting does not delete previously synced personnel records -- they remain in ConcertoGRC but are no longer updated by sync.