Via Custom Admin Role

If you wish to delegate Zluri’s Azure AD integration to a non-admin user or group, you can assign them a custom admin role. This method requires more manual configuration compared to the OAuth method, but gives greater control over the Zluri features you wish to use.

Prerequisites

• An account with Owner or User access administrator privileges (only required for creating a custom admin)
• Any Microsoft Entra ID subscription
• An account with Privileged Role Administrator or Global Administrator privileges (only required for assigning the custom admin role)

Create a custom admin role

1. In the Azure Portal, open either Management Group, Subscription, or Resource Group (depending on your use case) where you want to assign the custom role, then open Access control (IAM).

   

2. Click the Roles tab to see a list of all the built-in and custom roles.

3. Search for a role you want to clone. Click the 3-dot menu towards the right of the row and click Clone. This will open the custom roles editor.

   

4. In the Basics tab, write a name and description. Set Baseline permissions to Clone a role.

   

Add the required permissions

The new role needs the following permissions in Azure to function:

• Application.Read.All
• AuditLog.Read.All
• Directory.Read.All
• Group.Read.All
• GroupMember.Read.All
• IdentityRiskEvent.Read.All
• IdentityRiskyUser.Read.All
• User.Read.All
• UserAuthenticationMethod.Read.All

1. To do this, click the Permissions tab, then click ➕ Add permissions.

   

2. Search for one of the permissions mentioned above using the search bar. Then, click a resource provider card that has the permissions you want to add to your custom role, such as Microsoft Billing.

   

3. This will display a list of the management permissions for that resource provider. Click Add to append the permission to the role.

   

4. Repeat this for every permission mentioned above.

5. Go to the Review + create tab, review the permissions, then click Create.

   

Unhide user details in Azure AD

By default, user details are hidden for all Microsoft reports. You need to unhide them manually in the admin dashboard so that Zluri can access it:

1. Visit Admin Center, and navigate to Settings → Org Settings → Services. Select Reports.

2. Uncheck the Display concealed user, group, and site names in all reports checkbox, then save your changes.

   

Assign the custom admin role

A custom role with no assignee grants nothing, so the connection fails or returns empty data until the role is assigned. Assign the role before you connect the Azure AD instance in Zluri. If you already connected and the sync returns no users or fails on permissions, assign the role, then re-sync.

Before you start:

• You must be signed in as a Privileged Role Administrator or Global Administrator. No other role can create a role assignment, and the Add assignments button stays greyed out.
• The custom role already exists and has its nine permissions.
• You know which identity will authenticate the Zluri connection.

Assign the role to the account that will authorize the Zluri connection, not to yourself, unless you are that account.

1. In the Microsoft Entra admin center, go to Entra ID → Roles & admins → All roles, and type your role's name into the search box to filter the list.

   Select the role name itself. Do not select the checkbox next to it. Selecting the checkbox selects the role for deletion; selecting the name opens it.

   

   The Type column reads Custom for your role, and the Assignments column shows how many identities currently hold it.

2. The role opens on its Assignments page, listing everyone who currently holds it.

   

   If you see Eligible assignments, Active assignments, and Expired assignments tabs and a Privileged Identity Management subtitle, your tenant has Entra ID P2 with PIM. Follow With PIM in the next step. If you see a single plain list with no tabs, follow Without PIM.

3. Add the assignment:

   • Without PIM (Entra ID Free / P1): select + Add assignments. In the panel, search for and select the user, group, or service principal from the table above, then select Add. The assignment takes effect immediately and never expires.
   • With PIM (Entra ID P2): select + Add assignments. Choose the member you want to assign, then select Next. On Membership settings, set Assignment type. Set the duration, then select Assign.

4. Back on the role's Assignments page (refresh if needed), confirm your identity now appears with:

   • Type: User, Group, or Service Principal, matching what you intended
   • Scope: the directory or tenant name, for tenant-wide access
   • Membership: Direct
   • State: Assigned

   With PIM, check that it is listed on the Active assignments tab, not Eligible assignments.

After the role is assigned, connect the instance as described below. If the instance was already connected, trigger a fresh sync.

Troubleshooting

Connect the Azure AD instance in Zluri

1. Open the Integrations Catalog, search for “azure”, and click ➕ Connect on the Azure AD entry.

   

2. Choose the scopes for the integration, and click Connect. You can click the down-arrow button towards the right of a scope to find out what it does.

   

3. You will now see a popup window asking you to authorize the request on Azure AD’s end. Accept the request.

4. Give the connection a name and description, and you’re ready to go!

Important Note for Recently Created Entra/Microsoft Tenants

If you are connecting a new Microsoft Entra tenant (created within the past 48 hours), please note:

• It may take up to 48 hours after tenant creation for Entra to generate usage reports data.
• During this initial period, requests to the Reports APIs may fail.
• All other scopes and data—such as Users, Groups, Group Members, Applications, Licenses/SKUs, and Audit Logs—will function as expected.
• Reports data will only become available after Microsoft finishes initializing the new tenant.

Instructions

1. You can proceed with connecting your tenant to Zluri right away.
   Exclude the “read reports” scope; all other data will sync successfully.
2. Wait at least 48 hours after tenant creation before enabling the “read reports” permission.
3. Once this time has passed, add the “read reports” permission, and then re-connect the integration with Zluri.
4. If you're still facing issues, please contact Zluri Support.