Connected directly
Microsoft Entra ID: Access reviews without spreadsheet exports
Accounts, roles and groups come straight from Microsoft Entra ID.
How it works
- Register an app
You create your own app registration with read permissions only in your tenant and grant admin consent.
- Check the preview
The first run is a preview. Nothing is stored until you adopt it.
- Sync regularly
After that Complass syncs daily, or every six hours or weekly if you prefer.
- Access and evidence
Accounts and roles appear in access reviews. The evidence sits at the matching requirements of your frameworks.
Which data is exchanged
| Direction | Data | Note |
|---|---|---|
| Entra ID → Complass | Accounts with display name, sign-in name, enabled or disabled, member or guest | Guests appear as external accounts. |
| Entra ID → Complass | Role assignments, eligible roles from PIM and the groups you select | Eligible roles from PIM need Entra ID P2. Without P2 Complass skips them with a notice. |
| Entra ID → Complass (optional) | Last sign-in and whether MFA is registered | Needs Entra ID P1 and the permission AuditLog.Read.All. |
| Entra ID → Complass (evidence) | Only figures and settings, such as the share with MFA, conditional access rules and the number of global admins | Without names of people. |
| Complass → Entra ID | Nothing | Complass refuses access with write permissions. |
| Not read | Phone numbers, addresses, department, manager, photos, sign-in logs, IP addresses, devices, mailbox data and groups you did not select | Complass does not request this data at all. |
Setup
- Your own app registration in your tenant, sign-in with a client secret.
- Application permissions with admin consent: User.Read.All, GroupMember.Read.All and RoleManagement.Read.Directory. AuditLog.Read.All only for last sign-in and MFA.
- For evidence a second connection with its own app registration, among others with Policy.Read.All for the conditional access rules.
- The secret needs an expiry date of at most 24 months. Complass reminds you 30 and 7 days before.
- Administrators with the right for API, webhooks and integrations can set it up.
Security and data protection
- Read only: Complass checks the granted permissions and refuses write permissions and overly wide ones such as Directory.Read.All.
- The secret is stored encrypted in Complass; the access token exists only in memory for one run.
- If the tenant behind the app changes, Complass pauses the connection.
- An account only counts as removed when it is missing in two full runs 24 hours apart. If more than 20 percent go missing at once, Complass stops.
- Evidence contains no names of people.
Frequently asked questions
How does this differ from the Entra ID file import?
With the import you upload CSV files from the Entra admin centre; the data is as fresh as the last upload. The direct connection fetches the data itself and regularly, also reads eligible roles from PIM and selected groups, and replaces the file import.
Do we need Entra ID P1 or P2?
Not for accounts, roles and groups. Last sign-in and MFA status need P1, eligible roles from PIM need P2.
Can Complass change anything in Entra ID?
No. The connection only reads and does not run while the app has write permissions.
What if we maintain data in Complass by hand?
What you enter by hand in Complass takes precedence over the data from the connection.
More connections
Which packages include the connection to Microsoft Entra ID, see the package overview. See the packages
Product names and trademarks belong to their respective owners. There is no partnership, certification or endorsement by the owners. Microsoft and Microsoft Entra are trademarks of the Microsoft group of companies.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.