Entra ID
Microsoft Entra ID integration
IdentityAvailable
BRAIAN connects to Microsoft Entra ID through Microsoft Graph API, application permissions. Agents can user and group synchronisation, role mapping to agent permissions and single sign-on. Every action is scoped by the permissions granted to the integration and executed under a versioned policy. Each one is recorded in the audit log with the agent, timestamp and record touched.
What can BRAIAN do?
Users and groups are synchronised from Entra ID and mapped to agent permissions, so the directory stays the single place where access is decided. Single sign-on and access review data use the same connection.
| Capability | Agent | Read or write |
|---|---|---|
| User and group synchronisation | All agents | Read |
| Role mapping to agent permissions | All agents | Read |
| Single sign-on | Carol | Read |
| Access review data | SecAgent | Read |
How does it connect?
- Connection method
- Microsoft Graph API, application permissions
- Credential
- An Entra ID application with a certificate credential; no directory write permission is requested.
Credentials are held in an encrypted secrets store. BRAIAN never stores end-user passwords.
Which permissions are required?
- User.Read.AllReading user attributes needed to resolve identity and language.
- GroupMember.Read.AllGroup membership, which determines what each agent and each Carol instance may see.
- AccessReview.Read.AllExisting access review results, read only, used in certification processes.
Permissions are requested at the minimum scope the configured processes require. Unused scopes are not granted.
Which processes use it?
Processes that run on this connection, and the domains they belong to.
Data access review
Access certification
Employee onboarding
Used across every business domain.
Entra ID group membership maps directly to what each agent — and each Carol instance — is allowed to see.
How do you revoke access?
Access is revoked in Microsoft Entra ID itself — by disabling the credential or removing the granted scopes — or in BRAIAN by disconnecting the integration. Processes already running stop at their next call to Microsoft Entra ID and are held for review rather than completed with partial data; the interruption and the state of each process are recorded in the audit log.
FAQ
Does BRAIAN store data from Microsoft Entra ID?
BRAIAN reads what a process needs, when it needs it. Records retrieved from Microsoft Entra ID are held only for the duration of the process and in the audit trail of the actions taken; Microsoft Entra ID remains the system of record.
What happens if the connection fails mid-process?
The process stops at the failed step and is held for review. Nothing is written twice: completed writes stay recorded in the audit log and the remaining steps resume only once the connection is restored.
Can permissions be scoped per agent?
Yes. Scopes are defined per agent, not per system, so one agent can read while another cannot, on the same connection to Microsoft Entra ID.