Microsoft Entra ID
Entra already knows which applications your staff sign into and which groups they belong to. Urengi reads both, so a vendor nobody registered still shows up as a vendor, and every review lands with the group that owns it.
- Category
- Identity & SSO
- Auth method
- OAuth 2.0
- Direction
- Read-only
- Sync frequency
- Hourly
- Scopes requested
- 4
- Available on
- All plans
- Maintained by
- Urengi
What the Microsoft Entra ID integration does
Three reads, all of them facts your directory already holds.
Shadow vendors surface themselves
Enterprise applications with a sign-in in the last 90 days are matched against your vendor list. What is missing from the list is the interesting part.
Reviews route by group
Security, IT and Procurement groups map to reviewer roles once. New joiners inherit the routing without anyone editing a rota.
Access changes reopen a review
A vendor whose app suddenly gains a hundred more users is a different risk than the one you scored. Urengi reopens the review rather than waiting for the anniversary.
Exactly what Urengi can see
Four scopes, all read-only. Urengi cannot change a user, a group or an app registration.
Urengi reads
- Enterprise application names and owners
- Sign-in counts per application
- Group names and membership
- User display names and work emails
Urengi writes
- Nothing — this connection is read-only
Urengi never touches
- Passwords, MFA factors or session tokens
- Conditional access or tenant policy
- Mailboxes, files or Teams content
- Anything after you revoke consent
Connect it in four steps
One authorisation, one field mapping, and a test sync you run yourself.
01
Authorise the connection
Open Microsoft Entra ID from this page and approve the scopes listed above — OAuth in a browser tab, or a scoped API key you paste. An admin approves them once.
02
Choose what syncs
Pick the projects, spaces or accounts Urengi should watch. Narrow is fine to start with; widening it later does not re-authorise anything.
03
Map your fields
Match owners, cost centres and tiers to what Urengi already tracks. Defaults arrive pre-filled from the first sync, so most teams change nothing.
04
Run a test sync
Pull one record and check it landed on the right review. The audit entry confirms the mapping before a real vendor is touched.
Your token, your rules.
Urengi stores the Microsoft Entra ID token encrypted at rest under a per-tenant key and never replays it outside the scopes you approved. Revoke the app in Microsoft Entra ID and every Urengi write stops within seconds — the audit log keeps the history, the connection simply ends.
Read the security statement- SOC 2 Type II
- audited annually
- Per-tenant keys
- no shared secrets
- Revocable in Microsoft Entra ID
- one click, no ticket
- EU or US residency
- chosen at signup