Microsoft Entra ID (M365)
Discover which AI apps your Microsoft 365 users have consented to, via Microsoft Graph.
Airia reads your users and the OAuth consent grants made in your Microsoft 365 tenant, both organization-wide and per user, and identifies which of the consented apps are AI apps. You see which AI apps are connected to your users' identities, who granted them, and with which scopes. For AI sites people visit in the browser, use the Browser Extension.
Authentication model
A Microsoft Entra ID service principal with a client secret, using Microsoft Graph application permissions (no user delegation). Because Airia operates as the app itself, the permissions need admin consent.
Required Microsoft Graph application permissions
| Application permission | Why Airia needs it |
|---|---|
User.Read.All | Enumerate users and read user details |
Application.Read.All | Resolve the apps behind each grant |
DelegatedPermissionGrant.Read.All | List the OAuth consent grants in your tenant |
To revoke grants from inside Airia, use DelegatedPermissionGrant.ReadWrite.All in place of
DelegatedPermissionGrant.Read.All.
Before you start
- An Application Administrator or Cloud Application Administrator can create the app registration.
- Admin consent for Microsoft Graph application permissions needs a Global Administrator or Privileged Role Administrator.
Customer-side setup steps
- In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
Name it something like
airia-entra-discovery. Single tenant. - Certificates & secrets → New client secret. Generate and copy the value. Note when the secret expires and schedule a rotation before that date. When you rotate, paste the new value into the Airia connection.
- From the app overview, copy the Application (client) ID and Directory (tenant) ID.
- API permissions → Add a permission → Microsoft Graph → Application permissions (not Delegated). Add the three permissions from the table above.
- A Global Administrator or Privileged Role Administrator selects Grant admin consent for your tenant. Confirm the Status column shows every permission as granted.
- In Airia, go to Discover → Connect, filter by Identity, and select the Microsoft Entra ID tile. Create a connection with the tenant ID, client ID, and client secret. Set Maximum Users at or above your user count (default 1000).
Form fields the Airia UI asks for
| Field | Required | Notes |
|---|---|---|
| Azure Tenant ID | Yes | Entra tenant GUID |
| Client ID | Yes | App registration's client ID |
| Client Secret | Yes | Stored encrypted, masked on edit |
| Maximum Users | No | Maximum users enumerated per refresh; defaults to 1000. Raise it for larger tenants |
Good to know
- Maximum Users defaults to 1000. Set it at or above your user count so discovery covers every user in the tenant.
- Application permissions. Airia operates as the app, not on behalf of a user, so the permissions need admin consent.
- Revoke a grant from the inventory. Open Discover → Inventory, select the app, and click Revoke on a grant under OAuth Grants. Revoking an organization-wide grant removes it for every user it covers. To stop users consenting to the app again, restrict user consent in Microsoft Entra under Enterprise applications → Consent and permissions.
Multiple environments
Multiple Microsoft Entra ID connections per tenant are supported: typically one per Entra tenant (for example, a recently acquired company still on its own tenant). Each connection needs its own tenant-scoped service principal.