Bezpośrednio zintegrowane
Microsoft Entra ID: Przeglądy dostępu bez eksportu do Excela
Konta, role i grupy pochodzą prosto z Microsoft Entra ID.
Jak to przebiega
- Register an app
You create your own app registration with read permissions only in your tenant and grant admin consent.
- Check the preview
The first run is a preview. Nothing is stored until you adopt it.
- Sync regularly
After that Complass syncs daily, or every six hours or weekly if you prefer.
- Access and evidence
Accounts and roles appear in access reviews. The evidence sits at the matching requirements of your frameworks.
Which data is exchanged
| Direction | Data | Informacja |
|---|---|---|
| Entra ID → Complass | Accounts with display name, sign-in name, enabled or disabled, member or guest | Guests appear as external accounts. |
| Entra ID → Complass | Role assignments, eligible roles from PIM and the groups you select | Eligible roles from PIM need Entra ID P2. Without P2 Complass skips them with a notice. |
| Entra ID → Complass (optional) | Last sign-in and whether MFA is registered | Needs Entra ID P1 and the permission AuditLog.Read.All. |
| Entra ID → Complass (evidence) | Only figures and settings, such as the share with MFA, conditional access rules and the number of global admins | Without names of people. |
| Complass → Entra ID | Nothing | Complass refuses access with write permissions. |
| Not read | Phone numbers, addresses, department, manager, photos, sign-in logs, IP addresses, devices, mailbox data and groups you did not select | Complass does not request this data at all. |
Setup
- Your own app registration in your tenant, sign-in with a client secret.
- Application permissions with admin consent: User.Read.All, GroupMember.Read.All and RoleManagement.Read.Directory. AuditLog.Read.All only for last sign-in and MFA.
- For evidence a second connection with its own app registration, among others with Policy.Read.All for the conditional access rules.
- The secret needs an expiry date of at most 24 months. Complass reminds you 30 and 7 days before.
- Administrators with the right for API, webhooks and integrations can set it up.
Bezpieczeństwo i ochrona danych
- Read only: Complass checks the granted permissions and refuses write permissions and overly wide ones such as Directory.Read.All.
- The secret is stored encrypted in Complass; the access token exists only in memory for one run.
- If the tenant behind the app changes, Complass pauses the connection.
- An account only counts as removed when it is missing in two full runs 24 hours apart. If more than 20 percent go missing at once, Complass stops.
- Evidence contains no names of people.
Często zadawane pytania
How does this differ from the Entra ID file import?
With the import you upload CSV files from the Entra admin centre; the data is as fresh as the last upload. The direct connection fetches the data itself and regularly, also reads eligible roles from PIM and selected groups, and replaces the file import.
Do we need Entra ID P1 or P2?
Not for accounts, roles and groups. Last sign-in and MFA status need P1, eligible roles from PIM need P2.
Can Complass change anything in Entra ID?
No. The connection only reads and does not run while the app has write permissions.
What if we maintain data in Complass by hand?
What you enter by hand in Complass takes precedence over the data from the connection.
More connections
Which packages include the connection to Microsoft Entra ID, see the package overview. See the packages
Wymienione nazwy produktów i znaki towarowe należą do ich właścicieli. Nie istnieje żadne partnerstwo, certyfikacja ani rekomendacja ze strony właścicieli. Microsoft i Microsoft Entra są znakami towarowymi grupy przedsiębiorstw Microsoft.
Przetestuj Complass na własnych danych
Mogą Państwo samodzielnie założyć konto testowe, na życzenie z przykładowym projektem dla każdej regulacji. Jeśli wolą Państwo najpierw zobaczyć Complass, proszę umówić demo.