Microsoft Azure Active Directory (Azure AD) and Microsoft Intune

Use cases the adapter solves

Connecting Azure AD (renamed Microsoft Entra ID) to Axonius allows you to gain visibility into all registered devices and users that are a part of your Azure AD tenant. With this information you can evaluate devices that may be missing agents required for monitoring, devices missing from vulnerability assessment scopes, or evaluate permissions for your users, groups, or registered azure applications.

Enforcements
Axonius has a built-in enforcement for adding selected users/devices to an Azure AD group for further processing by administrators. Axonius users can also take advantage of on-premises Active Directory enforcements if they are running in a hybrid deployment model.

Related Enforcement Actions:

• Microsoft Azure (Azure AD) - Add or Remove Assets in Group

• Microsoft Azure (Azure AD) - Delete Assets

• Microsoft Azure (Azure AD) - Enable Assets

• Microsoft Azure (Azure AD) - Disable Assets

This adapter fetches the following types of assets:

• Devices

• Users

• SaaS data
  Data retrieved by Azure AD
  The Azure AD adapter is able to fetch a wide variety of user and device data, including usernames, group membership details, device ownership, user license details, login activity/risky user assessments, O365 activity, and more.

To successfully connect this adapter, you need to complete the following steps.

Accounts with only Cybersecurity Asset Management:

1. Create an Application Key

2. Set Permissions
   

Accounts with SaaS Management Capabilities:

1. Create an Application Key

2. Set Permissions

3. Create a User Account

4. Enable or Exclude Multi-Factor Authentication

Create an Application Key

1. Navigate to Microsoft Azure Admin Center > Azure Active Directory > Applications > Enterprise Applications.

2. Click New application.

3. From the Azure AD gallery, Click Create your own application.

4. In the Create your own application panel:

   1. Enter a What’s the name of your app of your choice (e.g. Axonius app).

   2. Select Register an application to integrate with Azure AD.
      

   • Click Create.

   • Enter a user-facing display name of your choice for this application (for example, "Axonius app display").

   • Select Accounts in this organizational directory only.

   • Click Register.

5. Go to Microsoft Azure admin center > Azure Active Directory > Enterprise applications.
   

6. From the All Applications page, click the application registrations link.
   

7. Select the newly created application.

8. Hover over the Application (client) ID field and click to copy the ID.

9. In Axonius, paste the copied ID in the Azure Client ID field in the Adapter setup.

10. Hover over the Directory (tenant) ID field and click to copy the ID.

11. In Axonius, paste the copied ID in the Azure Tenant ID field in the Adapter setup.

12. Back in Azure, from the Manage left-menu, select Certificates & secrets.

13. Under Client Secrets, click New client secret.

14. In the Create secret panel, set the expiration time to the furthest possible date (24 months or higher).

15. Click Add.

16. Paste the copied secret into the Azure Client Secret field in Axonius.

Set Permissions

This section details how you can set permissions for the user you created that allow the adapter to import and sync data with Azure AD, Microsoft 365 and Intune.

1. From the Manage left-menu, select API Permissions.

2. From the API permissions page, click Add a permission.

   1. In the Request API permissions window, under the Microsoft APIs tab, click Microsoft Graph.

   2. Select Application permissions.
      

   • Use the search bar to locate and select the permissions. See Required Permissions for the full list of relevant permissions and what they are each needed for.

   • Click Add permissions.

3. From the API permissions page, click Grant admin consent for Default Directory, and approve the request.
   

Required Permissions

This table summarizes permissions that Axonius requires to fetch various Azure resources.
Use this information both to enable required permissions, and to only apply necessary permissions.

Create a User Account

You can create a new user account for fetching SaaS data.

The Username and Password that you create should be used for the optional UserName and Password connection parameters.

1. Go to Microsoft 365 admin center > Users > Active users.

2. Click Add a user.
   

3. Enter a Display name of your choice.

4. Enter a Username of your choice (for example: usr_axonius).

5. Back in Axonius, in the User Name field, enter the user name and domain name using the format 'username@domainname'.
   For example: [email protected].

6. In the Admin Center, enter a strong password.

7. Copy the password and, back in Axonius, paste it in the Password field.

8. In the Microsoft 365 Admin Center, clear the Require this user to change their password when they first sign in checkbox.

9. Click Next.

10. Select Create user without product license.

11. Click Next.
    

12. Click Roles, then select Admin center access.

13. Select Global reader.

14. Click Next.
    

15. Click Finish adding.

16. Click Close.

Enable or Exclude Multi-Factor Authentication

Depending on your organization's security policies or exclude the user from the MFA policy.

This section is only relevant for accounts with SaaS Management capability.

Enable MFA for the User Account

1. Enable MFA for newly created user account:

   1. Navigate to Microsoft 365 Admin Center > Users > Active users and click Multi-Factor Authentication.
      

   2. Open the service settings tab.
      

   3. Under the Methods available to users setting, select the Verification code from mobile app or hardware token option.

   4. Click Save.
      

   5. Navigate to the users tab.

   6. Select the newly created user and in the Quick Steps section on the right, click Enable.
      

   7. When prompted, select enable multi factor auth.

2. Configure the Authenticator app and generate the secret key:
   a. Log into Microsoft 365 with the newly created user account.
   b. Click the account profile avatar and select View account.
   c. From the left menu, select Security Info.
   d. Click Add sign-in method and select Authenticator app.
   f. Click Add.
   g. In the Microsoft Authenticator page, click I want to use a different authenticator app.
   

   h. Click Next until a QR code is displayed.

   i. Click Can't scan image?.
   j. Click to copy the Secret key.
   
   k. Back in Axonius, paste the copied code in the 2fa Secret Key field.
   
   

3. Generate the verification code:

   1. Back in the Azure MFA Configuration panel, click Scan QR Code to display the QR Code again.

   2. On your personal mobile device, download and open the Google Authenticator and click +.

   3. Scan the QR code. Google Authenticator displays a verification code.

   4. Copy the verification code that appears in the field below.

   5. Enter the verification code in Azure MFA Configuration and click Verify.

Exclude the User Account from Multi-Factor Authentication

If your organization's security policy allows it, you can exclude the user you created from the MFA policy by excluding a designated IP range. After you exclude the account from MFA, follow these steps to set up exclusions from conditional access policies.

1. In Axonius, ensure that the Enable 2FA checkbox is cleared.

2. Go to Microsoft Azure admin center > Azure Active Directory > Security > Named locations.

3. Click Configure multifactor authentication trusted IPs.
   

4. Add the Axonius IP ranges.

5. Click Save.

Exclude from Conditional Access Policies

1. Navigate to Microsoft Azure admin center > Azure Active Directory > Security > Conditional Access.

2. Click a policy.
   

3. Open the Users or workload identities.

4. Under the What does this policy apply to? section, select Users and groups.

5. Click Exclude.

6. Select the Users and groups checkbox.

7. Open the Select excluded users and search for the newly created user account. Click the account and then click Select.

8. Click Save.
   

9. Repeat the process for each policy on the Conditional Access page.

The parameters that you need to fill out will differ based on the capabilities in your Axonius platform. 'General' pertains to users with Cybersecurity Asset Management and/or SaaS Management capabilities.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

General

To connect to Microsoft Azure AD, you need to create a Designated Axonius application in the Microsoft Azure Portal and grant it read-only permissions. All required credentials will be given once an application is created. For details, see Creating an application in the Microsoft Azure Portal.

• Azure Client ID (required) -The Application ID of the Axonius application.

• Azure Client Secret (required) - Specify a non-expired key generated from the new client secret.

• Azure Tenant ID (required) - Microsoft Azure Active Directory ID.

• Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

• SSO Provider - If your organization uses Microsoft Azure Active Directory for SSO, you can select this check box.
  For more information, see Connecting your SSO Solution Provider Adapter.

• Cloud Environment - Select your Microsoft Azure or Microsoft Azure AD cloud environment type.

• Azure Oauth Authorization Code (optional) - The authorization code to connect to Microsoft Intune. This is a legacy option to allow Oauth delegated authentication.

• Azure OAuth - Redirect URI/Reply URL - The location where the authorization server sends the user once the Azure has been successfully authorized and granted an authorization code or an access token. For more information, see Redirect URI (reply URL) restrictions and limitations.

• Is Azure AD B2C - Select this option to cause Axonius to consider that this Microsoft Azure AD adapter connection is configured as B2C.

• Account Tag (optional) - Specify a tag for Axonius to tag all devices fetched from this adapter for the Azure Cloud instance ("nickname").

• Device Groups Blocklist (optional) - Enter a group or groups whose devices will be ignored and not fetched. If you want to enter more than one group, separate with commas.

• HTTPS Proxy (optional) - A proxy to use when connecting to the selected Microsoft Azure / Azure AD cloud environment.

• HTTPS Proxy User Name and Password (optional) - The user name and password to use when connecting to the selected Microsoft Azure / Azure AD cloud environment via the value supplied in HTTPS Proxy.

SaaS Management

• Account Sub Domain - The Microsoft account's sub domain (<sub_domain>.onmicrosoft.com).

• User Name and Password - The credentials for a user account that has the permissions needed to fetch SaaS data.

• 2FA Secret Key - The secret generated in Microsoft Azure Active Directory for setting up 2-factor authentication for the Microsoft user.

General

• Fields to exclude (optional) - Specify a comma-separated list of fields to be excluded from the fetched data. This causes the adapter to exclude the listed fields from the raw and parsed data. For example, if this field value is "emailAddress, phoneNumber", both fields will be excluded from the raw and parsed data fetched by this adapter.

• Allow use of BETA API endpoints - Select whether Axonius will use Beta API as the default source of data.

• Number of parallel requests (optional, default: 100) - Specify the maximum number of parallel requests to obtain paged data from the Microsoft Azure AD cloud server.

• Max retry count for parallel requests (optional, default: 3) - Specify how many times this adapter will retry a parallel request when the Microsoft Azure AD cloud server returns a response with an error. If not supplied, Axonius will use the default value.

• Time in seconds to wait between retries of parallel requests (optional, default: 3) - Specify how many seconds this adapter will wait in between each retry when a parallel request to the Microsoft Azure AD cloud server returns a response with an error. If not supplied, Axonius will use the default value.

• Fetch email activity from Office 365 in the last X days (required, default: 0) - Specify the number of days to fetch email activity per each user. The email activities include:

  • Deleted users

  • Dates of account deletion of users

  • Number of times an email send action was recorded

  • Number of times an email received action was recorded

  • Number of times an email read action was recorded

  • Last time any user performed a read or send email activity

  • Report period

  • Products that are assigned to the users

  Note:

  In order to use this field the application permissions in Microsoft Azure Portal must include the following permissions:

  • reports.Read.All
    To unhide user-level information within O365, a global administrator needs to make that change in the Microsoft 365 admin center.

  • In the admin center, go to the Settings > Org Settings > Services page.

  • Select Reports.

  • Clear the statement Display concealed user, group, and site names in all reports, and then save the changes. Refer to Microsoft Documentation - Show User Details in the Reports

• Exclude Azure AD joined devices - Select this option to exclude Azure AD joined devices from data fetched by this adapter.

• Fetch custom user flow attributes (Requires IdentityUserFlow.Read.All permission) - Select this option to fetch extra custom user flow attributes to be added dynamically to the User’s assets data.

• Fetch "Guest" users (required, default: true) - Select this option to fetch external users from Azure AD.

• Fetch deleted users - Select this option to also fetch users that were deleted in Azure AD.

• Fetch only devices - Select this option to only fetch devices and not fetch users. Only Device.Read.All permissions are required here, and the permission “Directory.Read.All” is not required.

• Skip devices fetch - Select this option to only fetch users, and disable fetching of devices.

• Fetch only users with account enabled (optional) - Select to fetch only users with an account enabled in the Azure AD.

• Fetch risky users information - Select whether to fetch information about risky users. Information includes:

  • If the user was deleted

  • Is processing

  • Date the user last updated

  • Risk level

  • Risk state

  • Risk details

  Risky users are defined in risky User resource type and in What is risk?.

• Fetch risky users information with selected Level (required, default High)- Select levels of risky users' information to fetch. Otherwise all levels are fetched

• Fetch risky users information with selected 'State' (required, Default - At Risk, Confirmed Compromised.) - Select states of risky users' information to fetch. Otherwise all states are fetched.

• User groups exclude list (optional) - When Fetch user groups is selected, users who have groups listed in this field will not be added to Axonius. If Fetch user groups is not selected, this field has no effect. The contents of this field are comma-separated strings, which are case and space sensitive.

• Fetch software information from Intune (required, default: Disabled) - Select whether to fetch installed software from Intune.

  • When set to 'Disabled', no installed software is fetched from Intune.

  • 'Enabled in Normal Fetch' fetches installed software from Intune during the regular fetch time.

  • 'Enabled in Background' schedules the fetch of installed software from Intune outside the regular fetch time.

• Fetch devices from Intune (required, default: true) - Select whether to fetch devices from Intune.

• Fetch user groups (required, default: true) - Select this option to fetch information on every group a user is a member.

• Fetch user app roles - Select whether to retrieve the app roles that are assigned to a user.

  Note:

  If selected, you must have either the Directory.Read.All or AppRoleAssignment.ReadWrite.All permission.

• Fetch user assigned roles (Permissions required Directory.Read.All or RoleManagement.Read.Directory) (optional) - Select whether to fetch the assigned roles of a user. When Allow use of BETA API endpoints is also selected, then transitive assigned roles are also fetched.

• Fetch nested groups - Select to fetch groups that belong to other groups.

• Fetch users Last Sign-In - How to fetch (required, default Disabled) - Define how to fetch the data about the users Last Sign-in. Use this setting together with ‘Fetch users Last Sign-In - API to use’.

  • When set to 'Disabled' no data about users last sign in is fetched, and the ‘Fetch users Last Sign-In - API to use’. Setting will also be disabled.

  • 'Enabled in Normal Fetch' fetches the information during the regular fetch time.

  • 'Enabled in Background' schedules the fetch of this information outside the regular fetch time.

• Fetch users authentication methods (required, default: true) - Select to fetch data from the users authentication_methods endpoint. When this is cleared data is not fetched from the authentication_methods endpoint.

• Fetch user Last Sign-In -API to use (required, default Disabled) - Select the type of API the adapter uses to fetch information when 'Fetch users Last Sign-In - How to fetch' is not set to 'Disabled'.

  • 'Use Regular API' - fetches only 30 days of users Sign-In in activity, with geolocation and device data. Requires normal license

  • 'Use BETA API' - fetches all the possible users last Sign-In activity, with no geo and device data. Requires BETA license.

  • 'Use Both APIs' - fetch all data from both APIs

  Note:

  • If the ‘Use Beta API’ is selected, Axonius considers the following values in fetching last sign-in data:

    lastSignInData > beta > signInActivity > lastSignInDateTime

    lastSignInData > beta > signInActivity > lastNonInteractiveSignInDateTime
    

  • If ‘Use Regular API’ is selected, Axonius considers the value of lastSignInData > regular > createdDateTime
    

  • If ‘Use Both APIs’ is selected, Axonius considers all of the above values. Axonius always takes the most recent value.

• Fetch mobile devices (required, default: true) - Select whether to fetch iOS and Android devices.

• Avoid duplications in names - Select whether to create only one device when you fetch entities from Azure AD that contain the same name multiple times. In this case create only one device in Axonius using the name with the most recent last seen properties.

• Fetch Windows Defender Compliance state - Select this option to collect “Windows10CompliancePolicy.DefenderEnabled” Compliance state for any Intune device to the ”Windows 10 Defender Enabled State” field of the adapter.

• Fetch device owner - Select this option to fetch device ownership (username and email) information for this adapter.

• Fetch device groups - Select this option to fetch information on every Azure AD group for every device.

• Fetch Users managers - Select this option to fetch information about managers of Azure AD users.

• Use Beta API in Intune - Select to use the beta API to fetch Intune devices and additional data. If this option is cleared, the regular API is used.

• Intune OS filter - Select this option to filter the Intune devices fetched by Operating System. The default value is All. You can choose to only fetch Windows devices.

• Custom filter expression for fetching devices (optional) - Enter a filter expression to exclude Azure Active Directory devices from the fetch. For example, you could enter (operatingSystem ne ‘Windows’). For more information, see Operators and Functions Supported in $filter Expressions and Device Properties.

• Custom filter expression for fetching Intune devices (optional) - Enter a filter expression to exclude Intune devices from the fetch. For more information, see Operators and Functions Supported in $filter Expressions and Intune Managed Device Properties.

• Populate Cloud Provider Account Name aggregated field (required, default: true) - When this parameter is not set, the "Cloud Provider Account Name" aggregated field is not populated for devices for Azure AD.

• Do not fetch devices if Device Disabled field equals Yes (optional) - Select this option to exclude disabled devices from the fetch.

• Fetch only devices with last seen - Select this option to only fetch devices which have last seen.

• Fetch service principal as Users (default false) - Select this option to fetch service principals.

• Fetch Encryption Details from BETA Intune API (required, default false) - Select this option to fetch more detailed data about the encryption state of devices (states that indicate if a device is encrypted, if it has encryption policies, etc.) from the Managed Device Encryption State endpoint.

  • To fetch this data, your user account must include Beta and Intune licenses.

  • The Azure account must be granted ‘DeviceManagementConfiguration’ permissions.

  • The ‘Fetch devices from Intune’ must be enabled.

• Fetch Windows Endpoint Protection Configuration from BETA Intune API - Select this option to fetch Windows Endpoint Protection Configuration.

• Fetch Device Compliance Policies Details (required, default false) - Select this option to fetch information about the states of the compliance policies (Requires Intune License).

• Fetch Device Local Credentials (LAPS) from BETA Graph API - Select this option to fetch information about the local administrator credential information for all device objects that are enabled with Local Admin Password Solution (LAPS).

• Fetch Device Information Protection - Bitlocker Recovery Key - Select this option to fetch information about Bitlocker Recovery Key for all device objects that have a stored Bitlocker key.
  This setting only works with OAuth authentication and a delegated permission for all the assets that you want to retrieve. For more information, see Microsoft identity platform and OAuth 2.0 authorization code flow.

• Custom filter expression for fetching users (optional) - Enter a filter expression to exclude Azure Active Directory users from the fetch. For more information, see Use the Filter Query Parameter, Advanced query capabilities on Azure AD objects and User resource type.

• Fetch managed app registrations from MAM - Select this option to fetch managed app registrations from MAM.

• Fetch user application role details - Select this option to enrich user application roles with additional data such as the application role display name, description, and origin.

• Use asset name as hostname if hostname undefined - Select this option so if the hostname value is not defined, the hostname for each device will take the asset name as its value.

• Fetch Security Baseline Device States - Select this option to allow for enriching Intune devices with their Security Baseline states.

  Note:

  If selected, you must have the DeviceManagementConfiguration.Read.All and the DeviceManagementConfiguration.ReadWrite.All permissions.

Cybersecurity Asset Management

• Fetch extension attributes for device owner - Select this option to fetch additional extension attributes for the device owner user. This setting requires the ‘Fetch device owner’ setting to be enabled as well.

SaaS Management

• Fetch users license details - Select whether to fetch the licenses assigned to a given user.

• Fetch audit logs - Select this option to fetch audit logs.

• Fetch user assigned eligibility schedule - Select this option to fetch role eligibility schedule instances of groups.

• Fetch all directory roles - Select this option to fetch all directory roles.

• Fetch user extensions - Select this option to fetch user extension

• Fetch all role definitions - Select this option to fetch all the available roles in Azure AD, even those that are not in use.

• Fetch group app roles (Permissions required Directory.Read.All or AppRoleAssignment.ReadWrite.All) (default: False) - Set this option to fetch group app. roles and present the applications that are being used as an asset of the type Group. Refer to List appRoleAssignments granted to a group for further information.