Reading users from Microsoft Entra ID

Once Microsoft 365 is connected, MiraShield can also read your directory's users: who is an administrator, whether a second sign-in factor is required, and which accounts nobody uses. It is read-only, it uses the consent you already gave for Microsoft 365 so there is nothing new to approve, and the only thing kept is your tenant's id and name.

Before you start

• Microsoft 365 has to be connected first (see "Connecting a cloud account or code repository"). The Entra ID entry reads the same Microsoft tenant.
• You need to be an owner or administrator of your organization here. You do not need to sign in to Microsoft again.

How to set it up

1. Open Settings, then Connectors, and click "Add a connector".
2. Pick "Entra ID".
3. Click "Also read users". MiraShield asks Microsoft for your organization's name and one user to prove it can read the directory, and connects only if that works.
4. If it says your consent is out of date, consent again from the Microsoft 365 entry. Microsoft only shows the permissions that were added, and your existing connection is kept.

What it checks

• Administrators without a second sign-in factor.
• Accounts that have no second factor registered, and whether a second factor is actually enforced (by Microsoft's security defaults or by a Conditional Access policy that covers everyone).
• Accounts that have not signed in recently, and accounts that never have.
• That you have between two and four global administrators: fewer is a lockout risk, more is more access than needed.

Sign-in activity and second-factor registration are only available from Microsoft on tenants with Microsoft Entra ID P1. Without it, those checks say "unknown" instead of passing, and everything else still works. An unknown result is never counted as a pass. If your tenant's default domain changes, nothing needs to be redone: the connection follows your tenant, not its domain name.