Integrating with Microsoft Entra ID

Grant API Access to Microsoft Entra ID

1. Log into Azure Portal.
2. In the upper-left corner, click the menu icon.
   
3. Select Microsoft Entra ID.
   
4. Select App registrations.
   
5. In the top menu bar, click + New Registration.
   
6. On Register an application page, enter an application name.
   
7. In the Supported account types section, select an option per the following recommendations:
   • If you currently have, plan to have, or are unsure whether you will have more than one tenant, choose the Multitenant option. This option provides greater flexibility as it allows you to connect to multiple tenants using the same credentials.
   • If you're confident that you will have only one tenant, you may leave the Single tenant option selected. With this option, the connection will be limited to a single tenant. If you try to connect to another tenant, you will receive an error as this option only supports one tenant and generates credentials exclusively for that tenant.
     
     
8. Click the Register button. An Application (client) ID, Object ID, and Directory (tenant ID) are displayed. The IDs are needed to authenticate in BullPhish ID.
   
9. In the navigation menu, click API permissions.
   
10. Click Add a permission.
    
11. Click Microsoft Graph.
    
12. Click Application permissions.
    
13. Scroll down to Group, click the dropdown and select Group.Read.All.
    
14. Scroll down to User, click the dropdown and select User.Read.All. Click Add permissions.
    
15. On the API Permissions page, click Grant admin consent for Default Directory. This action requires admin-level access.
    
16. In the confirmation modal, click Yes.
17. In the navigation menu, click Certificates & secrets.
    
18. Click +New client secret. This secret is needed to authenticate with BullPhish ID.
    
19. In the Add a client secret pane, providing a Description is optional. In the Expires list, select when the secret should expire. Click the Add button.
    
20. Copy the Value field from the client secret you just created. You will need this value in the next procedure.
    

IMPORTANT  Make sure you copy the Value field, not the Secret ID number. The client secret is only visible temporarily and should be safely recorded or used, as it will not be retrievable later.

NOTE  To delete a client secret, click the delete icon at the end of the row. To create a new client secret, perform steps 17 through 19.

To sync BullPhish ID with Microsoft Entra ID, you will use account information that was created when you completed the procedures above.

1. Log into BullPhish ID.
2. In the navigation menu, select Targets & Groups > Directories.
   
3. in the upper-right corner, click + Add Directory Sync.
   
4. In the Add Directory Sync modal, complete the following:
   • Organization: Select the applicable organization.
   • Directory Type: Select Azure.
   • Client Secret: Paste the secret value you copied in step 18 from the previous procedure.
     Note: If you need to copy the secret value again, in Microsoft Azure, in the navigation pane, select Certificates & secrets, copy the Value field.
5. In Microsoft Azure, on the breadcrumb trail, click App registrations.
   
6. On the All applications tab and click the name of your application.  
   

NOTE  If you don't see your application listed, refresh the page.

7. On the App registration page:
   
   
   • Copy the Application (client) ID and paste it into the Client ID field in the Add Directory Sync modal.
   • Copy the Directory (tenant) ID and paste it into the Tenant ID field in the Add Directory Sync modal.
8. Directory Sync Preference: Select an option for handling targets in BullPhish ID after they have been deleted from Azure.
   
9. Do one of the following:
   • Click Save.
   • Click Save & Sync. The sync is executed and the Edit Directory page for the organization is displayed.
     
     Now you are ready to import and sync groups or targets from Azure Active Directory. Refer to the article, Syncing groups and targets