About

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service, which allows employees to sign in and access internal and external resources.

Why You Should Integrate

Integrating with a Directory Service like Microsoft Azure Active Directory will provide visibility and device presence awareness for an environment.

How Does the Integration Work

This integration pulls device objects from Azure AD that are either joined or registered to the domain. This can be controlled by identifying the TrustType Sevco will filter in or out within the configuration. By default, this integration will collect all three trustTypes but will not collect empty trustTypes. An empty trustType implies the device record comes from InTune, which is reported by the Microsoft InTune source.

This data is only used internally; we do not share it with any parties outside of Sevco. Refer to our privacy policy for details.

Configuration

Choose a Schema: A schema is a configuration template that defines a specific way to connect, authenticate, and interact with a source. The following are the available schemas
- OAuth2 with asset filtering: Will retrieve computer objects using OAuth2 authentication. Note: OAuth2 will require re-authentication every 90 days, requiring you to edit and re-activate the source.
- Client ID/Secret with asset filtering: Will retrieve computer objects using a client ID/secret.
Configure plugin: Configure the plugin with the required fields.

OAuth2 with asset filtering

Field	Description	Example
Include bring your own personal device	If selected will retrieve devices registered in Azure AD with a trustType of Workplace	n/a
Include cloud only joined devices	If selected will retrieve devices joined to Azure AD with a trustType of AzureAd	n/a
Include on-premises domain joined devices joined to Azure AD	If selected will retrieve devices in Hybrid Azure AD with a trustType of ServerAd	n/a

Client ID/Secret with asset filtering

Field	Description	Example
`Client ID`*	The Application (client) ID of the app created for access.	`00000000-0000-0000-0000-000000000000`
`Domain`*	The Directory (tenant) ID of the associated domain	`11111111-1111-1111-1111-111111111111`
`Client Secret`*	The value of the app's client secret created to authenticate with the source.	`***********************`
Include bring your own personal device	If selected will retrieve devices registered in Azure AD with a trustType of Workplace	n/a
Include cloud only joined devices	If selected will retrieve devices joined to Azure AD with a trustType of AzureAd	n/a
Include on-premises domain joined devices joined to Azure AD	If selected will retrieve devices in Hybrid Azure AD with a trustType of ServerAd	n/a

If you chose OAuth2 with asset filtering, log in with your Microsoft credentials and accept the permission request.
Configure Name: OPTIONAL: You can give the configuration a name to provide an identifiable attribute of the configuration to delineate other similar configurations.
Activate Config: To enable this configuration and begin pulling data select "Activate". If you wish to save the configuration to come back later to finish, select "Save Draft". This will save the configuration, but keep it disabled until Activated.

Source Documentation

Creating credentials

You'll be asked to provide source credentials that Sevco will use to connect to MS Azure AD.

OAuth2 with asset filtering

Use an existing MS Azure AD account with admin permissions authorized to grant permissions defined in the Required Permissions - OAuth2 with asset filtering section below.

Client ID/Secret with asset filtering

You'll be asked to provide a client secret that Sevco will use to connect to Microsoft Azure AD. This will require the creation of an application in Azure in order to provide API-based access. The following steps will walk you through creating a registered application and identify the necessary values to record for configuration. (Microsoft Documentation: Tutorial: Register an app with Azure Active Directory)

Go to Azure Active Directory > App registrations*

Create a new registration

Give the app a user-friendly name and click Register

Obtain the Application (client) ID and Directory (tenant) ID for configuring the source.

Obtain a secret by going to Certificates and secrets

Generate New client secret

Give the secret a Description and expiration that follows your password rotation policy.

Obtain (copy) the Client secret value

NOTE: Ensure to input the App Secret Value, not the Secret ID when configuring the plugin.

Add the appropriate permissions by following the steps in Required Permissions - Client ID/Secret with asset filtering below.

Required Permissions

OAuth2 with asset filtering

The OAuth authentication flow will ask the user to authorize Sevco access by requesting the following permissions

Type: Application permissions
Device.Read.All

Client ID/Secret with asset filtering

The configured app will require the following permissions

Type: Application permissions
Permission: Device.Read.All

The following steps will walk you through configuring the proper permissions

*Go to Azure Active Directory > App registration

Select the application created for Sevco when following the steps in Creating credentials - Client ID/Secret with asset filtering.

NOTE: Depending on who created the application, it could be present in All applications or Owned applications

Go to API Permissions

Add a permission

Select Microsoft Graph and add a Delegated permission

Check Device.Read.All and click Add permissions

Admin consent will be required. Grant the permissions by going to the Enterprise applications or requesting an admin to approve the request.

API Documentation

Microsoft Graph documentation

Contact Us

If you're having problems integrating a source, or if you've found something wrong in this document, please email us at support@sevco.io.

Tags: cloud, directory service