Skip to content

Microsoft Entra ID directory inventory

Microsoft Entra ID supplies user, group, and directory context so Venturi can attribute AI usage to workforce owners and teams.

Release state

This guide documents the read-only azure_ad connector implemented in the platform connector surface.

Required access

Grant a dedicated app registration these Microsoft Graph application scopes:

Scope Purpose
User.Read.All Read users, lifecycle status, and profile attributes.
Group.Read.All Read groups and membership context.
Directory.Read.All Validate tenant directory access and directory metadata.

Do not grant write or ReadWrite scopes.

Setup

  1. Create a dedicated app registration in the tenant.
  2. Grant the read-only Graph application scopes above and complete admin consent.
  3. Store the tenant ID and client ID, and store the certificate, federated credential configuration, or secret fallback in the tenant’s encrypted connector credential store. These are Microsoft Graph application permissions, not delegated user permissions.
  4. Configure VENTURI_AZURE_AD_TENANT_ID; set VENTURI_AZURE_AD_GRAPH_BASE and VENTURI_AZURE_AD_PAGE_SIZE only when your environment requires overrides.
  5. In Venturi, open Integrations and select Microsoft Entra ID and run Test connection.

The initial sync is a full directory inventory; later syncs use Microsoft Graph delta links rather than a time lookback. See the Microsoft Graph delta-query overview.

Verification

  • The connector inventory shows the connector as read-only.
  • User and group counts match the tenant scope you granted.
  • Deactivated users remain available for historical attribution rather than being removed from past records.
  • Coverage & unknowns no longer lists directory inventory as a would-close source for connected teams.

Rotation and offboarding

Rotate the app credential through your normal privileged-access process. If you remove the connector, new workforce joins, moves, and leaves stop updating until the connector is restored.