Authentication #

az login

az ad sp create-for-rbac --name CloudQuerySP

You can choose any name you'd like for your service-principal, CloudQuerySP is an example. If the service principal doesn't exist it will create a new one, otherwise it will update the existing one

{
  "appId": "YOUR AZURE_CLIENT_ID",
  "displayName": "CloudQuerySP",
  "password": "YOUR AZURE_CLIENT_SECRET",
  "tenant": "YOUR AZURE_TENANT_ID"
}

Exporting environment variables #

• AZURE_TENANT_ID is tenant in the JSON.
• AZURE_CLIENT_ID is appId in the JSON.
• AZURE_CLIENT_SECRET is password in the JSON.

export AZURE_TENANT_ID=<YOUR AZURE_TENANT_ID>
export AZURE_CLIENT_ID=<YOUR AZURE_CLIENT_ID>
export AZURE_CLIENT_SECRET=<YOUR AZURE_CLIENT_SECRET>

Adding permissions to the service principal #

To add the permissions open the Azure portal, search for Microsoft Entra ID and click the Microsoft Entra ID service to open the overview page. Then, click on Roles and administrators as shown in the image below.

Under Roles and administrators, search for the Global Reader role and click on it.

Under the Global Reader role, under the Manage->Assignments sidebar location, click on Add assignments.

Under Add assignments, click no members selected to open a search box for members.

Search for the service principal you created earlier and click on it.

To add specific permissions open App registrations from the Microsoft Entra ID overview page and click on the service principal you created earlier.

Under manage->API permissions click on Add a permission.

Chose Microsoft Graph.

Then click on Application permissions.

Search for the permission you need to add, for example AuditLog.Read.All, select it and click on Add permissions.

Repeat the process for all permissions required by the tables you want to sync. After adding all permissions, click on Grant admin consent for <your tenant> to finalize the process.

After granting the permissions, you should see a message like the one below.

Configuration #

kind: source
# Common source-plugin configuration
spec:
  name: entraid
  path: cloudquery/entraid
  registry: cloudquery
  version: "v3.3.0"
  tables: ["*"]
  destinations: ["postgresql"]

  # Entra ID specific configuration
  # Learn more about the configuration options at https://cql.ink/entraid_source
  spec:
    # Optional parameters
    # concurrency: 50000

Entra ID Spec #

• concurrency (integer) (optional) (default: 50000)

  A best effort maximum number of Go routines to use. Lower this number to reduce memory usage.
• scheduler (string) (optional) (default: dfs)

  The scheduler to use when determining the priority of resources to sync. Supported values are dfs (depth-first search), round-robin, shuffle and shuffle-queue.

  For more information about this, see performance tuning.
• table_options (Table Options spec) (optional)

  Options to apply to specific tables. See [Table Options](#Table Options) for more information.

Entra ID Table Options Spec #

• entraid_groups

  • filter (string) (optional)

    filter represents a filter query to apply when syncing the table. The value is passed directly to the Microsoft Graph API. For example, to filter groups by name, you can use the following filter query: startswith(displayName, 'CloudQuery'). For more information on filter queries, see the Microsoft Graph documentation.
• entraid_auditlogs_signins

  • filter (string) (optional)

    filter represents a filter query to apply when syncing the table. The value is passed directly to the Microsoft Graph API. For example, to filter sign-ins by date range, you can use the following filter query: createdDateTime ge 2025-01-20T00:00:00Z and createdDateTime le 2025-01-25T23:59:59Z. For more information on filter queries, see the Microsoft Graph documentation.
• entraid_users

  • include_signin_activity (boolean) (optional) (default: false)

    If true, the signInActivity field will be included in the sync. Please note this requires a Microsoft Entra ID P1 or P2 license, the AuditLog.Read.All permission and reduces the max page size to 120 resulting in a potentially slower sync.