Microsoft Configuration#

Prerequisites#

Create an app registration in App Registrations in the Azure portal.

Authentication#

Create a client secret for the app registration. Store the secret in an environment variable and note the Microsoft tenant ID and application client ID.

Required Permissions#

Grant the app registration these Microsoft Graph application permissions:

  • AdministrativeUnit.Read.All: Read all administrative units.

  • Application.Read.All: Read all applications.

  • Directory.Read.All: Read directory data.

  • Group.Read.All: Read all groups.

  • GroupMember.Read.All: Read all group memberships.

  • User.Read.All: Read all users’ full profiles.

Optional Permissions#

Grant these application permissions when ingesting the indicated data:

  • DeviceManagementManagedDevices.Read.All: Intune managed devices and detected apps.

  • DeviceManagementConfiguration.Read.All: Intune device configuration and compliance policies.

  • RoleManagement.Read.Directory: Entra directory role definitions and assignments.

Configure Cartography#

Provide these options:

  • --microsoft-tenant-id: Microsoft tenant ID.

  • --microsoft-client-id: App registration client ID.

  • --microsoft-client-secret-env-var: Name of the environment variable containing the client secret.

These credentials apply to all Microsoft Graph ingestion in the microsoft module, including Entra ID and Intune.

The deprecated --entra-tenant-id, --entra-client-id, and --entra-client-secret-env-var aliases remain accepted until Cartography v1.0.0. Do not mix --microsoft-* and --entra-* credential flags in one invocation.

Run Cartography#

export MICROSOFT_CLIENT_SECRET='<client-secret>'
cartography \
  --selected-modules microsoft \
  --microsoft-tenant-id '<tenant-id>' \
  --microsoft-client-id '<client-id>' \
  --microsoft-client-secret-env-var MICROSOFT_CLIENT_SECRET

References#