Connect & Integrate Azure

Introduction

This guide covers using YeshID’s Azure integration to connect your Microsoft Entra tenant and Azure subscriptions.

Once connected, YeshID imports:

• Users

• Groups

• Workload identities

• Application credentials

• Directory roles

• Enterprise app assignments

• Azure subscriptions and RBAC access

Steps

1. Sign in to the Microsoft Entra admin center
   Go to https://entra.microsoft.com and make sure you are in the correct tenant.

2. Create a new app registration
   In the left navigation, go to Microsoft Entra ID > App registrations > New registration.
   Use:

   • Name: YeshID Azure Integration

   • Supported account types: Accounts in this organizational directory only

3. Click Register.

4. Copy the Tenant ID and Client ID
   After the app is created, open the app’s Overview page and copy:

   • Directory (tenant) ID

   • Application (client) ID

5. You will paste these into YeshID later as:

   • Tenant ID

   • Client ID

6. Create a client secret
   In the app registration, go to Certificates & secrets > Client secrets > New client secret.

   • Add a description

   • Choose an expiration

   • Click Add

7. Copy the secret Value right away. Azure only shows it once.
   You will paste this into YeshID as:

   • Client Secret

8. Add Microsoft Graph application permissions
   In the app registration, go to API permissions > Add a permission > Microsoft Graph > Application permissions.
   Add these permissions:

   • Application.Read.All

   • Directory.Read.All

   • Group.Read.All

   • GroupMember.Read.All

   • RoleManagement.Read.Directory

9. Grant admin consent
   Still in API permissions, click Grant admin consent for your tenant.
   This integration uses app-only Microsoft Graph permissions, so admin consent is required.

10. Assign Reader at management-group scope
    Go to https://portal.azure.com and open Management groups.
    Select the management group that contains the subscriptions you want YeshID to import.
    If you want YeshID to import all subscriptions the app can access, use the Tenant root group.
    Then:

    • Open Access control (IAM)

    • Click Add role assignment

    • Choose the Reader role

    • Assign it to the app’s service principal / enterprise application you created above

11. The app registration and the service principal usually have the same name, such as YeshID Azure Integration.

12. Connect the integration in YeshID
    In YeshID, open the Azure integration and enter:

    • Tenant ID

    • Client ID

    • Client Secret

13. Save the integration.

14. Run a sync
    Start a sync in YeshID.
    YeshID will import all subscriptions that the app can read through the management group role assignment, along with Entra users, groups, workload identities, roles, and access data.

FAQ

Which subscriptions will YeshID import?

YeshID imports all subscriptions the integration can read.

If you assign Reader to a management group, subscriptions under that management group inherit access and will be imported.

Do I need to assign Reader on every subscription?

No. If you assign Reader at the management-group level, that access is inherited by child subscriptions.

Why don’t I see any subscriptions in YeshID?

Usually this means one of these is missing:

• The app’s service principal was not assigned Reader

• The role was assigned at the wrong scope

• The subscriptions are not under the management group you used

• Admin consent was not granted for the Microsoft Graph permissions

Which object should I assign the Reader role to?

Assign the role to the app’s service principal (also shown in Azure as the enterprise application), not just the app registration record.

What happens if I rotate the client secret?

Create a new client secret in Azure, then update the Client Secret value in YeshID.