Docs · Connect your tools
Connect Microsoft Entra ID
StackWeaver reads, and never changes, your Microsoft Entra tenant once a day. A workspace owner or admin presses Connect, an administrator of your tenant approves StackWeaver's app on Microsoft's own page, and nothing is typed or pasted. This guide says what is read, what the approval allows, which checks need a premium Microsoft licence, and how to remove it.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
1. What it collects
Once a day, and when a workspace owner or admin presses Run now, StackWeaver reads your tenant through Microsoft Graph (how it works). Each result is kept as an Evidence Object with a SHA-256 fingerprint (platform), including results that fail. StackWeaver keeps only the tenant id and no secret of yours (what is stored).
| Check (as shown in the portal) | What it looks at |
|---|---|
| MFA registration coverage | How many users have registered a multi-factor method. |
| MFA required for all users | Whether Conditional Access, or security defaults, require multi-factor sign-in for all users. |
| MFA required for administrators | The same, for administrators. |
| Legacy authentication blocked | Whether sign-in with legacy protocols is blocked. |
| Privileged role assignments | Who holds privileged directory roles. |
| Just-in-time (PIM) privileged access | Whether privileged access is eligible and activated on demand instead of permanent. |
| Stale and guest accounts | Accounts with no recent sign-in, and guest accounts. |
| Sign-in log retention | Whether sign-in records older than the period the check tests are available. |
2. What it does not do
- It cannot change anything: the permissions are read permissions.
- It does not keep display names or e-mail addresses: each result is a minimised summary of counts and opaque ids.
- It does not store a password, key or client secret of yours. The only credential is StackWeaver's own Microsoft app (what is stored).
- It does not issue certifications. A named reviewer decides whether evidence is accepted (editorial policy).
3. The access it needs
You give the access once, by approving StackWeaver's app as an administrator of your tenant: Microsoft requires a tenant administrator to sign in to complete the request (Microsoft). StackWeaver asks for four read-only Microsoft Graph application permissions and no others (setup). Application permissions apply to the whole tenant, not to one user.
| Permission | Why | If it is missing |
|---|---|---|
| AuditLog.Read.All | MFA registration report, sign-in log availability and last sign-in per user. | The affected checks show Could not check and name the permission. |
| Policy.Read.All | Conditional Access policies and security defaults. | The affected checks show Could not check and name the permission. |
| RoleManagement.Read.Directory | Directory role assignments and just-in-time (PIM) eligibility. | The affected checks show Could not check and name the permission. |
| User.Read.All | The list of users for the stale and guest account check. | The affected check shows Could not check and names the permission. |
Who can connect. Two things must both be true. First, in StackWeaver you must be a workspace owner or admin. Second, in Microsoft the account you sign in with must be a Global Administrator or a Privileged Role Administrator of the tenant, and hold that role right now: after you sign in, StackWeaver asks Microsoft which administrator roles that account holds, and connects only if one of the two is found (how it works). This is checked because approving the app gives StackWeaver read access to the whole tenant, so only someone who can decide that for the tenant should be able to connect it. If Microsoft cannot be asked, or does not answer clearly, StackWeaver does not connect.
If you use Privileged Identity Management. A role you are only eligible for is not active, so it does not count: an eligible assignment needs you to perform one or more actions before the role can be used (Microsoft). Activate the role in Microsoft first, wait for it to show as active, then press Connect again.
4. Connect steps
- In StackWeaver, open Evidence, then the Microsoft Entra ID evidence section, and press Connect Microsoft Entra ID. Only a workspace owner or admin sees the button.
- Microsoft asks you to sign in. Sign in as a Global Administrator or Privileged Role Administrator of the tenant you want to connect (active, not only eligible), and read the permissions Microsoft lists. They should be the four above.
- Approve. Microsoft then asks you to choose the account you are signing in with. StackWeaver learns which tenant you belong to from the signed reply Microsoft sends, not from the address it was sent back to (Microsoft, how it works), and asks Microsoft to confirm that your tenant approved the app before it saves anything.
- StackWeaver tests the connection at once. When the card says Connected, press Run now.
5. Checks your Microsoft Entra licence may not include
Some Microsoft Entra features need a premium licence. When your tenant does not have the licence for a check, the portal shows Not available on this Microsoft Entra licence. That is its own status: it is not a pass and not a fail (how it is shown).
| Check | Licence | Source |
|---|---|---|
| MFA required for all users, MFA required for administrators, Legacy authentication blocked | Conditional Access needs Microsoft Entra ID P1. Security defaults are available to all customers; when security defaults are on, StackWeaver uses them for these three checks. | Conditional Access, security defaults |
| Just-in-time (PIM) privileged access | Privileged Identity Management needs Microsoft Entra ID P2 or Microsoft Entra ID Governance. | Microsoft |
| MFA registration coverage, Stale and guest accounts, Sign-in log retention | Microsoft's reference pages for these reads name no licence tier, so none is claimed here (how we checked). Microsoft Q&A reports that a tenant without a premium licence gets a Graph error when it asks for users' sign-in activity (Microsoft Q&A). | See the next paragraph. |
How to fix. Find your tenant's current licence in the Microsoft Entra admin center, under Billing, Licenses, Licensed features (Microsoft). If a check you want shows this status, ask the person who manages your Microsoft licences to assign a licence that includes the feature, then press Run now. If you leave it, StackWeaver keeps showing the check as not available and never counts it as passed or failed. StackWeaver does not state prices: see Microsoft's licensing pages.
6. Reading the results
| Label | What it means |
|---|---|
| Pass | Microsoft returned a setting that meets the check when StackWeaver looked. |
| Fail | Microsoft returned a setting that does not meet the check. |
| Not enabled | There was nothing to check, or the feature is not switched on in the tenant. |
| Could not check | StackWeaver was not permitted to read it, or Microsoft did not answer. It does not mean the setting is fine, and it does not mean it is broken. |
| Not available on this Microsoft Entra licence | The check needs a Microsoft Entra licence the tenant does not have. It is not a pass and not a fail. |
7. Disconnect and revoke
- In the StackWeaver portal, open Evidence, Microsoft Entra ID evidence, and press Disconnect. StackWeaver deletes the tenant id it stored, and collection stops. Evidence already collected stays (how it works).
- To remove StackWeaver's access at Microsoft, an administrator of your tenant deletes the StackWeaver enterprise application: in the Microsoft Entra admin center, browse to Entra ID, then Enterprise apps, select the application, open Properties, select Delete and confirm (Microsoft). Microsoft asks for at least the Cloud Application Administrator role (Microsoft).
What remains. Past evidence stays in your workspace as the audit trail unless you ask for deletion. How StackWeaver keeps and deletes data is in the privacy policy. To ask for deletion, write to [email protected].
8. Troubleshooting
| What you see | What to do |
|---|---|
| The administrator declined on Microsoft's page, so nothing was connected | Press Connect again and approve, or ask an administrator of your tenant to do it. |
| Microsoft's approval could not be confirmed for that tenant | Ask an administrator of your tenant to press Connect and approve. |
| Microsoft's sign-in could not be confirmed, so nothing was connected | Press Connect and sign in with an account of the tenant you are connecting. |
| Only an administrator of the Microsoft tenant can connect it | Sign in with an account that holds the Global Administrator or Privileged Role Administrator role right now. If you hold it through Privileged Identity Management, activate it first, then press Connect again. If you are not an administrator, ask one to connect. |
| Microsoft did not say which tenant approved | Press Connect to try again. |
| That connection link expired after 10 minutes | Press Connect to start again. |
| That account is already connected to another StackWeaver workspace | Use the contact page: one tenant can be connected to one workspace. |
| Connected, but the test did not pass | The status below the card names the missing permission. Press Connect again so an administrator can approve all four. |
| Microsoft connection is not configured on our side yet | StackWeaver has not switched this connection on for your workspace yet. |
Still stuck? Use the contact page.
Sources and method
Statements about Microsoft link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.