Conectado directamente
Microsoft Entra ID: Revisiones de acceso sin exportar a Excel
Las cuentas, roles y grupos proceden directamente de Microsoft Entra ID.
Cómo funciona
- Register an app
You create your own app registration with read permissions only in your tenant and grant admin consent.
- Check the preview
The first run is a preview. Nothing is stored until you adopt it.
- Sync regularly
After that Complass syncs daily, or every six hours or weekly if you prefer.
- Access and evidence
Accounts and roles appear in access reviews. The evidence sits at the matching requirements of your frameworks.
Which data is exchanged
| Direction | Data | Aviso |
|---|---|---|
| Entra ID → Complass | Accounts with display name, sign-in name, enabled or disabled, member or guest | Guests appear as external accounts. |
| Entra ID → Complass | Role assignments, eligible roles from PIM and the groups you select | Eligible roles from PIM need Entra ID P2. Without P2 Complass skips them with a notice. |
| Entra ID → Complass (optional) | Last sign-in and whether MFA is registered | Needs Entra ID P1 and the permission AuditLog.Read.All. |
| Entra ID → Complass (evidence) | Only figures and settings, such as the share with MFA, conditional access rules and the number of global admins | Without names of people. |
| Complass → Entra ID | Nothing | Complass refuses access with write permissions. |
| Not read | Phone numbers, addresses, department, manager, photos, sign-in logs, IP addresses, devices, mailbox data and groups you did not select | Complass does not request this data at all. |
Setup
- Your own app registration in your tenant, sign-in with a client secret.
- Application permissions with admin consent: User.Read.All, GroupMember.Read.All and RoleManagement.Read.Directory. AuditLog.Read.All only for last sign-in and MFA.
- For evidence a second connection with its own app registration, among others with Policy.Read.All for the conditional access rules.
- The secret needs an expiry date of at most 24 months. Complass reminds you 30 and 7 days before.
- Administrators with the right for API, webhooks and integrations can set it up.
Seguridad y protección de datos
- Read only: Complass checks the granted permissions and refuses write permissions and overly wide ones such as Directory.Read.All.
- The secret is stored encrypted in Complass; the access token exists only in memory for one run.
- If the tenant behind the app changes, Complass pauses the connection.
- An account only counts as removed when it is missing in two full runs 24 hours apart. If more than 20 percent go missing at once, Complass stops.
- Evidence contains no names of people.
Preguntas frecuentes
How does this differ from the Entra ID file import?
With the import you upload CSV files from the Entra admin centre; the data is as fresh as the last upload. The direct connection fetches the data itself and regularly, also reads eligible roles from PIM and selected groups, and replaces the file import.
Do we need Entra ID P1 or P2?
Not for accounts, roles and groups. Last sign-in and MFA status need P1, eligible roles from PIM need P2.
Can Complass change anything in Entra ID?
No. The connection only reads and does not run while the app has write permissions.
What if we maintain data in Complass by hand?
What you enter by hand in Complass takes precedence over the data from the connection.
More connections
Which packages include the connection to Microsoft Entra ID, see the package overview. See the packages
Los nombres de productos y las marcas mencionados pertenecen a sus respectivos titulares. No existe ninguna asociación, certificación ni recomendación por parte de los titulares. Microsoft y Microsoft Entra son marcas del grupo de empresas Microsoft.
Pruebe Complass con sus propios datos
Cree usted mismo su acceso de prueba, con un proyecto de ejemplo por marco normativo si lo desea. Si prefiere que primero le mostremos Complass, solicite una demo.