Overview

The Microsoft Entra ID context connector builds a picture of your users, groups, devices, applications, directory roles, and MFA registration status into Torq's organizational context graph. This gives Torq the context it needs to enrich alerts, support investigations, and power the Context Graph page.

Key benefits

Simplified setup: Configure ingestion through a guided UI, no custom polling workflows or API logic required.
Richer triage: Auto Triage uses the context graph to enrich alerts with user identity, manager chain, group memberships, directory roles, and MFA status, helping analysts judge severity faster.
Flexible scoping: Ingest only the data streams relevant to your Entra ID configuration and use case.
Built-in reliability: Pagination, state tracking, and error handling are managed automatically to ensure consistent data delivery.

This is a context and enrichment connector; it builds a picture of your users, devices, and access into Torq's organizational Context Graph. It does not route alerts or events into Torq for triage. Detection routing is handled by the Microsoft Entra ID data connector.

Common scenarios

The same Context Graph powers multiple use cases, regardless of which vendors are connected.

Improving alert triage with organizational context

When an alert involves a user or device, Auto Triage enriches it with context from the Context Graph, including identity, role, group memberships, device ownership, management status, and access privileges. This context is incorporated into the triage verdict and displayed in the alert's Context Graph section, helping analysts assess risk more quickly. For example, an alert involving a privileged admin on an unmanaged device may warrant a different response than one involving a standard user on a managed corporate device.

Investigating entities and relationships

The Context Graph page is where analysts can explore users, devices, accounts, and their relationships without switching between vendor consoles. Common questions include:

Who owns this device, and is it managed?
Which groups and applications does this user belong to?
What resources can this account access?
How are these entities connected?

By centralizing organizational context, the Context Graph enables faster investigations and more informed security decisions.

Prerequisites

Before setting up the Microsoft Entra ID context connector, ensure the following:

Azure AD app registration: Create an app registration in the Azure portal prior to configuration.
API permissions: Grant the following Microsoft Graph Application permissions on the app registration. Each requires admin consent for the tenant.

Permission	What it enables
`User.Read.All`	Users and manager relationships
`Group.Read.All`	Groups
`GroupMember.Read.All`	Group memberships
`Device.Read.All`	Devices and registered owners
`Application.Read.All`	Service principals and app registrations
`RoleManagement.Read.Directory`	Directory roles and role assignments
`AuditLog.Read.All`	MFA registration status
`UserAuthenticationMethod.Read.All`	Per-user MFA authentication methods
`Policy.Read.All`	Conditional access policies (requires Entra ID P1 or above)
`IdentityRiskyUser.Read.All`	Risky user detections (requires Entra ID P2)
`IdentityRiskyServicePrincipal.Read.All`	Risky service principal detections (requires Entra Workload ID Premium)

Directory.Read.All is a broader scope that covers users, groups, devices, service principals, applications, and directory roles in a single grant. Customers who already have it granted do not need the individual scopes for those entities. AuditLog.Read.All and UserAuthenticationMethod.Read.All are still required separately for MFA registration status.
Policy.Read.All, IdentityRiskyUser.Read.All, and IdentityRiskyServicePrincipal.Read.All are optional and license-dependent. If the corresponding license is not active, the permission can be omitted. If the permission is granted but the license is missing, the endpoint returns no data and the rest of the integration continues to work normally.

How to use

Create an app registration in Azure

Log in: Go to the Azure portal and log in with an admin account.
Create a registration: Go to Microsoft Entra ID > App registrations and click New registration.
Name the app: Give it a unique and meaningful name (e.g., Torq Integration), leave the default account type, and click Register.
Add API permissions: Go to API permissions > Add a permission > Microsoft Graph > Application permissions. Add the required permissions listed in the Prerequisites section.
Grant admin consent: Click Grant admin consent for [your org] and confirm. All permissions must show a green granted status.
Create a client secret: Go to Certificates & secrets > New client secret. Give it a description and expiry, then click Add. Copy the secret Value immediately; it is shown only once.
Copy identifiers: From the app's Overview page, copy the Application (client) ID and Directory (tenant) ID.

Set up a context connector instance in Torq

Open connector setup: Go to Integrations > Context Graph > Microsoft Entra ID Context Connector and click Add Instance.
Configure connection details:
- Name: Enter a descriptive name for the connector instance.
- Tenant ID: Enter your Azure Directory (tenant) ID.
- Client ID: Enter your app registration's Application (client) ID.
- Client Secret: Enter the secret value copied during app setup.
- Microsoft Graph Base URL: The base endpoint for Microsoft Graph API requests. Use https://graph.microsoft.com/ for commercial and GCC tenants, or https://graph.microsoft.us/ for GCC High. Include the trailing slash. The base URL must match the cloud in the Token URL.
- Token URL: The full OAuth 2.0 token endpoint for your Entra ID tenant. Use the URL that matches your cloud environment:
  - Commercial and GCC: https://login.microsoftonline.com/<tenant-id>/oauth2/v2.0/token
  - GCC High: https://login.microsoftonline.us/<tenant-id>/oauth2/v2.0/token
  Replace <tenant-id> with your Directory (tenant) ID.
Save configuration: Click Add to create the connector. Ingestion starts automatically.

You've successfully set up the Microsoft Entra ID context connector in Torq. With the instance configured, Torq will continuously ingest users, groups, devices, service principals, directory roles, and MFA registration status into the Context Graph. This context is available immediately for alert enrichment in Auto Triage and for investigation in the Context Graph page.

If a selected data stream is unavailable due to a missing permission, Torq skips that stream and continues ingesting the rest. Only the unavailable subset is missing; other data is unaffected.

Microsoft Entra ID Context Connector