Microsoft Entra ID
Employee accounts are read from Entra and matched with leak records; sessions of approved accounts are terminated.
How it works
The connection uses an Entra app registration. Reading the directory requires the User.Read.All permission; terminating sessions is a separate permission (User.RevokeSessions.All), and without it the connection only does matching.
The fields read are limited: account identifier, primary address, whether the account is enabled and whether it is a guest. No other profile information is read.
Synchronisation never starts on its own. The preview shows which records would be created, which updated and which sent for review; applying is a separate step.
Limits
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.