---
updatedAt: 2025-09-09T21:37:45.000Z
agentTools:
  projectIndex: https://help.zluri.com/llms.txt
---

# Via Custom Admin Role

Connect Azure AD to Zluri using a custom admin role

If you wish to delegate Zluri’s Azure AD integration to a non-admin user or group, you can assign them a **custom admin role**. This method requires more manual configuration compared to the [OAuth method](https://help.zluri.com/docs/connect-azure-ad-to-zluri-oauth), but gives greater control over the Zluri features you wish to use.

## Prerequisites

* An account with **Owner** or **User access administrator** privileges (only required for creating a custom admin)
* Any Microsoft Entra ID subscription

> 🚧
>
> If you wish to use the **Audit Log** scope in Zluri, you'll need an **Entra ID P1** or **Entra ID P2** subscription

### Create a custom admin role

1. In the [Azure Portal](http://portal.azure.com), open either **Management Group**, **Subscription**, or **Resource Group** (depending on your user case) where you want to assign the custom role, then open **Access control (IAM)**.

   ![](https://files.readme.io/9fd814c7faa8e978929893cf81017b3e2242df6b575412f610e43a0425f79fb1-image.png)
2. Click the **Roles** tab to see a list of all the built-in and custom roles.
3. Search for a role you want to clone. Click the 3-dot menu towards the right of the row and click **Clone**. This will open the custom roles editor.

   ![](https://files.readme.io/df8d57ecd2bb69c0153c1aa34dd8ca88061f72c7cade9c58d6096c4448b72c52-image.png)
4. In the **Basics** tab, write a name and description. Set **Baseline permissions** to **Clone a role**.

   ![](https://files.readme.io/8ec532df6b4810bfce1996ada0fea98118d5833f008557d480e0b497302da066-image.png)

### Add the required permissions

The new role needs the following permissions in Azure to function:

* `Application.Read.All`
* `AuditLog.Read.All`
* `Directory.Read.All`
* `Group.Read.All`
* `GroupMember.Read.All`
* `IdentityRiskEvent.Read.All`
* `IdentityRiskyUser.Read.All`
* `User.Read.All`
* `UserAuthenticationMethod.Read.All`

1. To do this, click the the **Permissions** tab, then click ➕ **Add permissions**.

   ![](https://files.readme.io/75c13b8a1fdb02942aeb7224e149729ac91486beda61804fce729db50384f4c7-image.png)
2. Search for one of the permissions mentioned above using the search bar. Then, click a resource provider card that has the permissions you want to add to your custom role, such as Microsoft Billing.

   ![](https://files.readme.io/6d3c704b7cfe1c714bd8707c66e6800204bf1f8a224fb008904605f699c1bc08-image.png)
3. This will display a list of the management permissions for that resource provider. Click **Add** to append the permission to the role.

   ![](https://files.readme.io/e658f38cee27f813be0867525e5baee2487c073a12f7997da014d7d5f69e370b-image.png)
4. Repeat this for every permission mentioned above.
5. Go to the **Review + create** tab, review the permissions, then click **Create**.

   ![](https://files.readme.io/1a29051e5ab3fc2d904728826d08d7036ac02398ff2db74c01855e14fbd63242-image.png)

### Unhide user details in Azure AD

By default, user details are hidden for all Microsoft reports. You need to unhide them manually in the admin dashboard so that Zluri can access it:

1. Visit [**Admin Center**](https://entra.microsoft.com/), and navigate to **Settings →** **Org Settings** → **Services**. Select **Reports**.
2. Uncheck the **Display concealed user, group, and site names in all reports** checkbox, then save your changes.

   ![](https://files.readme.io/a9f8f9e2ffc66848012a1feda04faa7654830ef320f8542a5dfe67aba11117a7-image.png)

### Connect the Azure AD instance in Zluri

1. Open the [Integrations Catalog](https://app.zluri.com/integrations/catalog)**,** search for “azure”, and click ➕ **Connect** on the **Azure AD** entry.

   ![](https://files.readme.io/e371396886c88f2a7765e67e5822184ba31bdc96f0ae97f97efd9aa54da9248f-image.png)
2. Choose the scopes for the integration, and click **Connect**. You can click the down-arrow button towards the right of a scope to find out what it does.

   ![](https://files.readme.io/6ed7a112c8668f52f3ac95db01e7ca896aeb25e8a8cdb1ed42195211fbca37d6-image.png)
3. You will now see a popup window asking you to authorize the request on Azure AD’s end. Accept the request.
4. Give the connection a name and description, and you’re ready to go!

> ## Important Note for Recently Created Entra/Microsoft Tenants
>
> If you are connecting a new Microsoft Entra tenant (created within the past 48 hours), please note:
>
> * It may take up to **48 hours** after tenant creation for Entra to generate usage reports data.
> * During this initial period, requests to the **Reports APIs** may fail.
> * All other scopes and data—such as **Users**, **Groups**, **Group Members**, **Applications**, **Licenses/SKUs**, and **Audit Logs**—will function as expected.
> * Reports data will only become available after Microsoft finishes initializing the new tenant.
>
> ### Instructions
>
> 1. You can proceed with connecting your tenant to Zluri right away.\
>    *Exclude the “read reports” scope; all other data will sync successfully.*
> 2. Wait at least **48 hours** after tenant creation before enabling the **“read reports”** permission.
> 3. Once this time has passed, add the **“read reports”** permission, and then re-connect the integration with Zluri.
> 4. If you're still facing issues, please contact **Zluri Support**.

Got questions? Feel free to [submit a ticket](https://support.zluri.com/support/tickets/new) or contact us directly at <support@zluri.com>.