How to Connect Microsoft Entra ID to AllowNow

The Microsoft Entra ID (formerly Azure AD) connector pulls your directory — users, directory role assignments (Global Administrator and friends), and group memberships — into AllowNow on a read-only basis, normalises it to access levels, and flags drift: anyone in Entra who isn't documented in AllowNow, and any AllowNow user who has left the directory. Authentication uses an Entra app registration with read-only Microsoft Graph permissions. It can never change your directory.

Prerequisites

A Global Administrator (or Privileged Role Administrator) in Entra — you need to grant admin consent
Access to the Microsoft Entra admin center (entra.microsoft.com) or Azure portal
AllowNow owner access — connectors live under Connectors in the sidebar

Register an application

3 minutes

In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration. Name it e.g. AllowNow Connector, leave the defaults (single tenant is fine), and register.

On the app's Overview page, copy the Directory (tenant) ID and the Application (client) ID — you'll need both.

Add read-only Graph permissions and grant admin consent

5 minutes

This is the step people miss — the app can read nothing until an admin consents.

Open the app → API permissions → Add a permission → Microsoft Graph → Application permissions (not delegated).
Add these four read-only permissions:

User.Read.All Directory.Read.All RoleManagement.Read.Directory AuditLog.Read.All

Click Grant admin consent for [your tenant] and confirm. Each permission should show a green "Granted" status.

Note: use Application permissions, not Delegated — the connector runs headless (client-credentials), with no signed-in user. AuditLog.Read.All is what lets AllowNow read MFA registration status; without it everything else still works, MFA just shows as "unknown".

Create a client secret

2 minutes

On the app → Certificates & secrets → Client secrets → New client secret. Give it a description and expiry, then copy the secret Value immediately (not the Secret ID) — it's only shown once.

Heads-up: client secrets expire (max 24 months). Set a reminder to rotate it and re-enter the new value in AllowNow before it lapses, or syncs will start failing with a 401.

Connect the app in AllowNow

2 minutes

In AllowNow: Connectors → Add connector → Microsoft Entra ID. Fill in:

Directory (tenant) ID — from step 1.
Application (client) ID — from step 1.
Client secret — the Value you copied in step 3.

Click Connect & test. Credentials are encrypted at rest and never returned to the browser.

Sync and review drift

2 minutes

On the connector card, click Sync now. AllowNow pulls users, directory-role holders, and group memberships. Open Drift review to see:

Undocumented access — someone in Entra who isn't an AllowNow user. Click Import user to add them.
Stale record — an AllowNow user who has left the Entra directory. Click Remove user to deactivate them.

Bonus: MFA registration status flows onto each user, powering the NIS2 report's multi-factor-authentication finding (Art. 21(2)(j)) — no manual attestation needed for Entra-managed accounts.

Troubleshooting

❌ 403 / "Authorization_RequestDenied"
→ Permissions weren't admin-consented, or you added Delegated instead of Application permissions. Re-check step 2 and click Grant admin consent.
❌ 401 / "invalid_client"
→ Wrong or expired client secret, or the wrong tenant/client ID. Confirm you copied the secret Value, not the Secret ID.
❌ MFA shows "unknown"
→ AuditLog.Read.All wasn't granted. Add + consent it, then re-sync.
❌ Users don't match existing AllowNow users
→ Matching is by email (mail / userPrincipalName). If your Entra UPNs use a different domain than your AllowNow user emails, import the directory users first.

Keep your directory continuously reconciled

Once connected, AllowNow keeps a living record of who has access to what across Entra — with periodic reviews, MFA evidence, full audit trails, and one-click compliance reports.

Get started free