Microsoft Entra ID (M365)
Discover which AI apps your Microsoft 365 users have consented to, via Microsoft Graph.
Airia connects to your Microsoft 365 tenant through Microsoft Graph and enumerates users plus their OAuth permission grants (consents to third-party and AI apps). This powers Shadow AI visibility for M365 tenants: who has consented to which AI app, whether grants are organization-wide or per-user, and admin-initiated revocation of a grant.
Authentication model
A Microsoft Entra ID service principal with a client secret, using Microsoft Graph application permissions (no user delegation). Because Airia operates as the app itself, admin consent is always required.
Required Microsoft Graph application permissions
Airia uses the Graph scope https://graph.microsoft.com/.default, so the effective
permission set is exactly what an admin consents to. The minimum set:
| Application permission | Why Airia needs it |
|---|---|
User.Read.All | Enumerate users and read user details |
Application.Read.All | Resolve the service principals (apps) behind each grant |
DelegatedPermissionGrant.ReadWrite.All | List each user's OAuth2 permission grants, and delete a grant when an admin invokes revocation |
Note on DelegatedPermissionGrant: Microsoft Graph does not offer a read-only application
permission for the OAuth2 permission-grant object. The least-privileged application
permission for both reading and listing grants is DelegatedPermissionGrant.ReadWrite.All.
That is Graph's design; a narrower read-only equivalent cannot be granted today.
Customer-side setup steps
- In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
Name it something like
airia-entra-discovery. Single tenant. - Certificates & secrets → New client secret. Generate and copy the value.
- From the app overview, copy the Application (client) ID and Directory (tenant) ID.
- API permissions → Add a permission → Microsoft Graph → Application permissions (not Delegated). Add the three permissions from the table above.
- Click Grant admin consent for your tenant.
- In Airia, go to Discover → Connections → Microsoft Entra ID and create a new connection with the tenant ID, client ID, and client secret. Optionally set Max users.
Form fields the Airia UI asks for
| Field | Required | Notes |
|---|---|---|
| Tenant ID | Yes | Entra tenant GUID |
| Client ID | Yes | App registration's client ID |
| Client secret | Yes | Stored encrypted, masked on edit |
| Max users | No | Maximum users enumerated per refresh; defaults to 1000. Raise for larger tenants |
Known limitations and optional features
- Max users defaults to 1000. For a tenant with more users, raise it; otherwise discovery covers only the first 1000 users returned.
- Application permissions only. Airia operates as the app, not on behalf of a user, so admin consent is mandatory.
- Revocation is gated. Deleting an OAuth grant only happens through an explicit admin action in the Shadow AI inventory. Airia never auto-revokes grants.
Multiple environments
Multiple Microsoft Entra ID connections per tenant are supported: typically one per Entra tenant (for example, a recently acquired company still on its own tenant). Each connection needs its own tenant-scoped service principal.