Microsoft Entra ID / Azure AD Integration Guide

Prerequisites

• An Azure AD (Microsoft Entra ID) tenant with an active subscription
• Admin rights to create users, groups, and apps (minimum: Application Developer role)

1. Group Setting

You will have two main options when using an Entra Group for integration. This can either be a new group created specifically for your CSA services or an existing group that is already configured. The steps for each option are outlined below.

a) Creating a New Security Group

1. Go to entra.microsoft.com
2. Navigate to: Identity > Groups > All groups > + New group
3. Set:
   • Group type: Security
   • Group name: Cyber Security Awareness
   • Membership type: Dynamic User (Recommended for automation, this can also be an Assigned group)
     • If using a Dynamic User Group you will need to add a dynamic query:
       Click Edit and paste: (user.accountEnabled -eq true) and (user.mail -ne null)in the Rule Syntax popup box.
       Note: This dynamic query is a recommended starting point to include active users with a valid email address. You can customise the rule to suit your organisation’s requirements.
       
4. Click OK, then Save
5. Click Create
6. The list will populate within 15 minutes with all active users who have email addresses.

b) Use an Existing Group

1. Go to entra.microsoft.com
2. Navigate to: Identity > Groups > All groups

3. Copy the group name exactly as it appears and include it within the information sent across to the CSA Team.

   (In this case you would copy All Company and include this in the information to send across.)
   

2. Register a New Application

1. Go to: Identity > Applications > App registrations > + New registration
2. Set:
   • Name: Cyber Security Awareness AD
   • Supported account types: Choose based on your requirements
   • Redirect URI: Web > Enter the URL(s) provided by CSA (https://satt-dev.co.uk/oauth is only an example. If you have multiple services with us then you will need to enter additional Redirect URIs via the Overviewsection on your created Application)
3. Click Register
4. Go to:API Permissions > Add a permission > Microsoft Graph > Delegated permissions
5. Search for each of the below and tick the box next to each one by one:
   1. offline_access
   2. openid
   3. email
   4. User.Read.All
   5. GroupMember.Read.All
6. Then select Application permissions and add the following:
   1. User.Read.All
   2. GroupMember.Read.All
7. Once all have been ticked, click Add Permissions
8. Go back to Overview and copy:
   • Application (client) ID*
   • Directory (tenant) ID*

*Keep these IDs safe to share with CSA later.

3. Create a Client Secret

1. Go to: App registrations > Cyber Security Awareness AD > Certificates & secrets > + New client secret
2. Description: CSA
3. Expiry: Custom
4. Start Date: Today's date
5. End Date: 2 years on from today's date
6. Click Add
7. Copy the value immediately—it will not be shown again*

4. Create a CSA Admin Account

To enable secure and stable integration between Lucy Security and Microsoft Entra ID, a dedicated admin account is required. This account authorises directory-level permissions via OAuth, enabling uninterrupted sync without MFA prompts. Credentials are never stored—access is token-based. We recommend creating a service account with the least privilege required.

1. Go to: All users > New user > Create new user
2. Set:
   • User principal name: csa@yourdomain.com
   • Display Name: Cyber Security Awareness Admin
   • Copy the generated password
3. Under Assignments > Add role, select: Cloud Application Administrator
4. Click Review and create
5. Copy the username and password and send all of the saved information to CSA (Consult the below checklist to make sure you have everything).

What to Send to Cyber Security Awareness

Once all steps are completed, send the following details to your CSA Technical Contact via the Support Desk: