Skip to main content

Azure Entra ID Integration

The Corsha mIDP integrates with Microsoft Azure Entra ID (formerly Azure Active Directory) to automatically import and synchronize application identities, service principals, and managed identities as machine identities. This integration enables organizations to leverage Azure's cloud identity platform while applying Corsha's zero-trust access controls.

Overview​

Azure Entra ID provides identity and access management for cloud applications, services, and resources. The Corsha integration imports Azure application registrations, service principals, and managed identities into the mIDP, creating machine identities that can be organized into groups and protected with connection rules and protocol enforcement policies.

Key Benefits:

  • Automated Identity Import: Azure service principals and managed identities are automatically imported as machine identities
  • Continuous Synchronization: Identity information remains current as Azure Entra ID detects changes
  • Multi-Tenant Support: Support for multiple Azure tenants in a single Corsha deployment
  • Cloud-Native Integration: Leverage Azure's native identity services with Corsha access control
  • OAuth 2.0 and OIDC Support: Use standard authentication protocols for machine-to-machine communication

Identity Information Imported​

The following information is imported from Azure Entra ID:

  • Application Identity: Application (client) ID, object ID, display name
  • Service Principal Details: Service principal type, application owner information
  • Managed Identity Information: System-assigned vs. user-assigned managed identity type
  • Authentication Details: Client credential expiration, certificate thumbprints
  • Azure Metadata: Resource tags, subscription information, resource group
  • Permissions: API permissions and delegated permissions granted to the application
  • Last Activity: Most recent sign-in timestamp

Use Cases​

Cloud Application Access Control​

Control access between Azure-hosted applications and services:

  • Import Azure App Service managed identities as machine identities
  • Create connection rules for Azure Function to Azure Function communication
  • Apply protocol enforcement to Azure container applications
  • Monitor API calls between Azure services

Multi-Cloud Identity Management​

Unify machine identity management across cloud providers:

  • Import identities from both Azure Entra ID and AWS Cognito
  • Maintain consistent policies across Azure and AWS workloads
  • Centralize machine identity visibility across clouds
  • Apply zero-trust controls regardless of cloud provider

Service Principal Governance​

Manage and secure Azure service principals:

  • Automatically group service principals by Azure subscription or resource group
  • Apply connection rules based on service principal roles
  • Monitor service principal authentication attempts
  • Track credential expiration and rotation

Configuration​

Adding Azure Entra ID Connection​

Step 1: Access Cloud Identity Sources​

  1. Navigate to the Identity Sources page in the Corsha Console
  2. Scroll down to the Cloud Identity Sources section
  3. Click the New Connection button in the upper-right corner

Step 2: Select Azure​

A dialog will appear prompting you to select your cloud identity provider. Click the + button below Azure to configure Azure Entra ID integration.

Step 3: Provide Connection Details​

Fill in the following required fields:

  • Tenant ID* (required): Your Azure Entra ID tenant identifier
    • Find in Azure Portal: Azure Active Directory > Overview > Tenant ID
  • Client ID* (required): The application (client) ID from your Azure app registration
    • Create in Azure Portal: Azure Active Directory > App registrations > New registration
    • After registration, copy the Application (client) ID
  • Client Secret* (required): The client secret value generated for your Azure application
    • Generate in Azure Portal: App registrations > Your app > Certificates & secrets > New client secret

Optional fields:

  • Workspace ID: Azure Log Analytics Workspace ID (to monitor secret hygiene)

Step 4: Configure Azure Permissions​

The Azure application registration requires the following Microsoft Graph API permissions:

  • Application.Read.All: Read applications and service principals
  • Directory.Read.All: Read directory data

To grant these permissions:

  1. Navigate to App registrations > Your app > API permissions
  2. Click Add a permission > Microsoft Graph > Application permissions
  3. Select Application.Read.All and Directory.Read.All
  4. Click Grant admin consent for your tenant

Step 5: Complete the Connection​

  1. Fill in all required fields with your Azure Entra ID credentials
  2. Click Test Connection to verify the configuration
  3. If successful, save the connection to begin syncing machine identities
  4. Configure synchronization frequency and attribute mapping
  5. Specify default machine group assignments for imported identities
Configuration Access

Contact your Corsha Technical Point of Contact (TPOC) for assistance configuring the Azure Entra ID integration and obtaining necessary Azure credentials.

Supported Azure Entra ID Versions​

The Corsha integration supports Azure Entra ID via Microsoft Graph API v1.0 and beta endpoints.

Next Steps​