Focus

Identity

Set Up an Entra ID Directory

Table of Contents

Set Up an Entra ID Directory

Learn how to set up an Entra ID directory in the Cloud Identity Engine.

Where Can I Use This?	What Do I Need?
NGFW Prisma Access	The Cloud Identity Engine service is free; however, the enforcement points utilizing directory data may require specific licenses. Click here for more information.

Configure Microsoft Entra ID (formerly Azure AD) in the Cloud Identity Engine to allow the Cloud Identity Engine to collect directory data for policy rule enforcement and user visibility.

To configure directory sync with an Entra ID tenant using the Cloud Identity Engine Enterprise app, you must be an Entra ID Global Administrator or have a Global Administrator available to complete the app registration using the onboarding URL.

As an alternative, you can configure the SCIM connector to select and synchronize the Entra ID attribute data you want to collect with the Cloud Identity Engine.

To further reduce sync time and minimize the amount of data collected by the Cloud Identity Engine, you can configure the Cloud Identity Engine to sync only specific groups from your directory by filtering the groups. Because SCIM is most suitable for small and frequent data requests, Microsoft restricts directory update intervals to once every 40 minutes. If you filter the groups instead, directory updates can occur as often as every 5 minutes. Choose the best option for your deployment based on your organizational and regulatory requirements.

The Cloud Identity Engine retrieves updates from your Entra ID tenant using the following schedule:

Users, Groups, and Devices—When the Cloud Identity Engine syncs changes.
Apps—Every x hours (where x is either a maximum of 3 hours or the duration necessary to complete the previous apps sync).
Role Assignments—Every x hours (where x is either a maximum of 24 hours or the duration necessary to complete the previous role assignment sync).

When you configure Entra ID for the Cloud Identity Engine, log in, and grant the necessary permissions, Microsoft automatically onboards the Cloud Identity Engine Enterprise App into Entra ID.

Configure Entra ID Using the CIE Enterprise App

Learn how to configure Microsoft Entra ID in the Cloud Identity Engine using the CIE Enterprise app.

Copy the Directory ID for your Entra ID tenant.
1. Log in to the Microsoft Entra admin center or the Azure administrator portal using the credentials of the account you want to use to connect to the Cloud Identity Engine (for example, a service account) and select Overview.
2. Copy the Directory (tenant) ID and store it in a secure location.
Set up your Entra ID tenant in the Cloud Identity Engine.
1. In the Cloud Identity Engine app, select Directories, then click Add New Directory.
2. Set Up an Entra ID Cloud Directory.
(Optional) Select additional information types to collect from Entra ID.
The CIE Enterprise app automatically requests the privileges necessary to retrieve directory information, user risk information, and any other additional info you choose to collect. If you enable an option that requires additional privileges, you must reconnect the directory. For configurations that use the CIE Enterprise app, use the CIE Enterprise App onboarding URL in step 4.2 to grant the necessary privileges.
After onboarding the app into Entra ID, you can revoke privileges if they are not necessary for your configuration. Do not revoke privileges for options you select. If you revoke a privilege required for an option you select or for the Cloud Identity Engine by default, the sync cannot complete.
To restore revoked permissions, edit the directory configuration and complete steps 4.1 through 4.5.
The following list provides the permissions for each additional information type.
Collect user risk information from Entra ID Identity Protection:
IdentityRiskyUser.Read.All
IdentityRiskEvent.Read.All
For more information, refer to Create a Cloud Dynamic User Group.
Collect Roles and Administrators (Administrative roles): Directory.Read.All or RoleManagement.Read.Directory
Collect enterprise applications: Application.Read.All
Collect device information: Device.Read.All
1. Collect user risk information from Entra ID Identity Protection to use in attribute-based Cloud Dynamic User Groups.
2. Collect Roles and Administrators (Administrative roles) to retrieve roleAssignments attribute information for users and groups.
  
  Allowing the Cloud Identity Engine to include this information for analysis helps to prevent role-based malicious attacks.
  
  By default, the Cloud Identity Engine enables this option for tenants who are associated with Cortex XDR.
3. Collect enterprise applications data so that it displays when you View Directory Data. If you don't want to collect the application data or you don't use application data in your Security policy, deselect the check box to decrease the sync time.
4. Collect device information.
  
  This data is used by Cortex XDR and Device Security.
Configure your Entra ID information in the Cloud Identity Engine.
1. Enter the directory ID you copied in step 1.2 as the Directory ID.
2. Generate the CIE Enterprise App onboarding URL to register the CIE Enterprise App in your Entra ID tenant.
  Registering the app in Microsoft Entra ID requires the Global Administrator role.
  
  If you do not have Global Administrator privileges in Entra ID, you must generate the URL and share it with an Entra ID administrator with Global Administrator privileges (Global Administrator role).
  
  Click Generate URL.
  Copy the resulting URL.
  Depending on your Entra ID role, perform one of the following actions:
  (Global Administrator) Open the URL in a new tab or window to register the app instantly.
  (Non-Global Administrator) Share the URL with an Entra ID administrator (Global Administrator) to complete the registration offline, then return to the Cloud Identity Engine.
3. Enter the email address or phone number for the Global Administrator Role account you use to connect to the Cloud Identity Engine then click Next.
4. Enter your password and Sign in.
5. Click Accept to grant the necessary permissions for your Entra ID directory.
  When you accept, Entra ID automatically enables the following required permissions, as well as the additional information type permissions listed in step 3:
  Device.Read.All—Application, Read all devices
  Group.Read.All—Application, Read all groups
  User.Read.All—Application, Read all users' full profiles
  User.Read—Delegated, Sign in and read user profile
6. Click Test Connection to confirm that the Cloud Identity Engine can successfully connect to your Entra ID tenant.
7. (Optional) Enter a custom Directory Name (Optional) to use in the Cloud Identity Engine.
(Optional) Upload a .CSV file to use as a filter for groups.
1. Click Upload CSV to upload a comma-separated value (CSV) file to use as a filter.
2. Drag and drop the .CSV file or click Browse files to select the .CSV file you want to use as a filter.
3. Select the Upload Type for the filter.
  Update Filters—Update the existing filters with the .CSV data.
  Replace Existing Filters—Replace the existing filters with the .CSV data.
4. Select the Attribute Name you want to use for the filter (Name or Unique Identifier).
5. Click Apply to confirm the changes.
(Optional) Filter Entra ID Groups.
1. Select the group attribute you want to use as a filter.
  Name—Filter the groups based on the group name.
  Unique Identifier—Filter the groups based on the unique identifier for the group.
2. Select how you want to filter the groups.
  (for Name attribute only) begins with—Filter the groups based on a partial match for the text you enter.
  
  The filter supports spaces in the search query.
  
  is equal to—Filter the groups based on an exact match for the text you enter.
3. Enter the search query you want to use to filter the groups (either alphanumeric characters for a name or numeric characters for a unique identifier).
4. (Optional) Configure an additional filter by clicking Add ORAdd Filter and repeating the previous three steps for each filter you want to include.
  If you select additional attributes as match conditions, the Cloud Identity Engine initially attempts to find a match for the first condition, then continues to match based on the additional conditions you specify.
Submit your changes and verify your directory information when the Directories page displays.

Configure Azure Using the Client Credential Flow

The Client Credential Flow option for Azure Active Directory (AD) in the Cloud Identity Engine allows you to use a service account to log in to your Azure AD in the Cloud Identity Engine. Using a service account is strongly recommended, as this is a more secure method for directory access and does not require the account to be associated with a specific user.

If this is the first time you have created a Cloud Identity Engine tenant, the Cloud Identity Engine app is not available in the Azure app gallery, so you must create a custom app.

If you already have an existing Azure AD configuration in the Cloud Identity Engine, you can easily migrate the existing configuration to use the client credential flow option by reconnecting your Azure AD to the Cloud Identity Engine, selecting the Client Credential Flow option, and testing the connection to verify the configuration.

If you have not already done so, activate your Cloud Identity Engine tenant.
Grant the required read-only permissions in the Azure Portal.
1. In the Azure Portal, select HomeAzure Active DirectoryApp Registrations.
2. Click New registration.
3. Enter a Name then click Register.
4. Select API permissions then click Add a permission.
5. Click Microsoft Graph then select Application permissions.
6. Select the following permissions then click Add permissions:
  Device.Read.All—Application, Read all devices
  GroupMember.Read.All—Application, Read all groups
  User.Read.All—Application, Read all users' full profiles
  User.Read—Delegated, Sign in and read user profile
  
  The permissions listed above represent the minimum required permissions that use least privilege access. If you prefer a less granular scope that is simpler to implement, you can use these permissions instead:
  Directory.Read.All
  Organization.Read.All
  
  If you want to use user risk information in attribute-based Cloud Dynamic User Groups, you must grant additional permissions. For more information, refer to the documentation on how to Create a Cloud Dynamic User Group.
  If you want to collect information on roles and administrators, if you have already granted the Directory.Read.All scope, no further permissions are required. If you are using the scopes listed above, you must also grant the RoleManagement.Read.Directory scope to collect role and administrator information. For more information, refer to step 6.
  If you want to collect enterprise application data, you must also grant the Application.Read.All scope. For more information, refer to step 7.
7. Click Grant admin consent for DirectoryName (where DirectoryName represents the name of your Azure AD).
8. Click Yes to confirm.
Collect the necessary configuration information from the Azure Portal.
1. In the Azure dashboard, select your Azure AD, then select App Registrations and select the app you created.
2. Select Certificates & secrets then click New client secret.
3. Enter a Description and Add the secret.
  
  When you add the secret, make sure to keep track of when the secret Expires. When the secret expires, you must configure the new secret in the Azure Portal and update the configuration in the Cloud Identity Engine app to replace the expired secret. Keep this in mind when selecting the expiry value for the secret. If you prioritize ease of configuration, select a longer expiration for the secret (the maximum value is 2 years). If security is of greater concern, select a shorter value for the secret’s expiration (the default is 6 months).
4. Copy the Value of the secret and store it in a secure location.
5. Click Overview then copy the Application (client) ID and store it in a secure location.
6. Copy the Directory (tenant) ID and store it in a secure location.
Add your Azure AD directory in the Cloud Identity Engine.
(Required for migration) If you are migrating an existing Azure AD configuration, select ActionsReconnect on the Directories page for the Azure AD you want to migrate. The Cloud Identity Engine automatically populates the necessary information so you can continue to step 9 (testing the connection).
1. In the Cloud Identity Engine app, select Directories then click Add New Directory.
2. Set Up an Azure directory.
Select whether you want to Collect user risk information from Azure AD Identity Protection to use in attribute-based Cloud Dynamic User Groups.

If you select this option, you must grant additional permissions for the Cloud Identity Engine in the Azure AD Portal. For more information, refer to the documentation for Cloud Dynamic User Groups.
Select whether you want to Collect Roles and Administrators (Administrative roles) to retrieve roleAssignments attribute information for users and groups. Allowing the Cloud Identity Engine to include this information for analysis helps to prevent role-based malicious attacks.

By default, the Cloud Identity Engine enables this option for tenants that are associated with Cortex XDR.

If you do not see the Collect Roles and Administrators (Administrative roles) option, reconnect your directory to select the option.
Select whether you want to Collect enterprise applications data so that it displays when you View Directory Data. If you don't want to collect the application data or you don't use application data in your security policy, deselect the checkbox to decrease the sync time. If you select this option, you must enable additional permissions for the Cloud Identity Engine (see step 2.6).

For beta users of this feature, the Cloud Identity Engine continues collecting enterprise application data for any directories configured in your tenant during the beta and no further configuration is required. If you configure a new directory, you must select whether you want to collect enterprise application data from the new directory.

Enter your directory information as indicated, using the information you copied from the Azure Portal in steps 3.4:

During migration of an existing Azure AD configuration to the client credential flow, the Cloud Identity Engine automatically populates the Directory ID.

Copy from Azure Portal	Enter in Cloud Identity Engine
Directory (tenant) ID	Directory ID
Application (client) ID	Client ID

(Required) Confirm the Cloud Identity Engine app can successfully communicate with your directory.
1. In the Cloud Identity Engine, click Test Connection to confirm that the Cloud Identity Engine can successfully connect to your Azure AD.
2. (Optional) Enter a new name to Customize Directory Name in the Cloud Identity Engine.
(Optional) Select whether you want to Filter Azure Active Directory Groups.
To reduce sync time and minimize the amount of data collected by the Cloud Identity Engine, you can configure the Cloud Identity Engine to sync only specific groups from your directory. To do this, you can Configure SCIM Connector for the Cloud Identity Engine or you can filter the groups. Because SCIM is most suitable for small and frequent data requests, directory update intervals are restricted to once every 40 minutes. If you choose to filter the groups instead, directory updates can be as often as every 5 minutes. Choose the best option for your deployment based on your organizational and regulatory requirements.
1. Select the group attribute you want to use as a filter.
  Name—Filter the groups based on the group name.
  Unique Identifier—Filter the groups based on the unique identifier for the group.
2. Select how you want to filter the groups.
  (for Name attribute only)begins with—Filter the groups based on a partial match for the text you enter.
  is equal to—Filter the groups based on an exact match for text you enter.
3. Enter the text you want to use to filter the groups.
4. (Optional) Configure an additional filter by clicking Add OR and repeating the previous three steps for each filter you want to include.
  When you configure additional attributes, the Cloud Identity Engine initially attempts to find a match for the first criteria in the configuration, then continues to attempt to match based on the additional criteria you specify.
Submit your changes and verify your directory information when the Directories page displays.

You can now use your Azure AD to enforce group-based policy with the Cloud Identity Engine.