Microsoft Entra ID integration
Entra ID access changes,
recorded and verifiable.
Governax records access changes from Microsoft Entra ID into a tamper-evident ledger: directory role assignments, group membership and ownership, user lifecycle, credentials and MFA, app consent and Conditional Access policy changes. A tenant administrator grants read-only admin consent once, Governax then reads the directory audit log every 10 minutes, and no credential of yours is stored.
What lands in the ledger
What does Governax record from Microsoft Entra ID?
Directory roles
Role grants and revocations, naming the role, whether the holder is a user or a service principal, and whether the assignment is active or PIM-eligible.
Group membership and ownership
Members added and removed, and owners added to or removed from groups, applications and service principals.
User lifecycle
Users created, deleted, restored, enabled and disabled, and external users invited.
Credentials and MFA
Password changes, MFA factors added and removed, and MFA resets.
Applications and service principals
Apps created and deleted, app assignments, and client secrets or certificates added to or removed from an app.
Consent grants
Third-party app consent granted and revoked, with the permissions that were actually granted.
Conditional Access
Policies created, changed and deleted.
Groups and domains
Groups created and deleted, and domains added, verified or removed.
Not captured: Failed attempts, account state that did not actually change, profile edits such as job title or manager, and routine service activity are deliberately dropped, so the governance signal stays readable.
How does the Microsoft Entra ID connection work?
A Global Administrator or Privileged Role Administrator accepts Microsoft's admin-consent screen for four read-only Microsoft Graph application permissions: AuditLog.Read.All, Directory.Read.All, RoleManagement.Read.Directory and Organization.Read.All. Before anything is saved, Governax proves it can authenticate to your tenant with that consent.
Consent is recorded on Microsoft's side against Governax's own app registration, and Governax mints short-lived, tenant-specific tokens from it whenever it reads. The only thing stored on the connection is your tenant id.
Governax polls every 10 minutes. The first poll backfills the previous 7 days, or as much as your tenant retains, and each later poll re-reads a 1-hour trailing window. Microsoft keeps directory audit records for 7 days without a Premium licence and 30 days with Entra ID P1 or P2.
The baseline snapshot on connect
When you connect, Governax snapshots every user (display name, user principal name, and whether the account is enabled) and every holder of every activated directory role, including service principals, as access.baseline_observed events. Group membership is not in the snapshot; group changes are captured from connect time forward.
Scope
What Governax does not do
Governax is a system of record, not a control plane. It records Microsoft Entra ID access changes after they have happened; it does not grant, revoke or block anything.
It never writes to your directory
Governax reads audit records and directory objects only. It never reads mailboxes, files or passwords.
It stores no secret of yours
There is nothing to rotate, nothing that can expire and nothing to leak. Revocation is yours, under Enterprise applications.
It does not withdraw consent on disconnect
Disconnecting stops polling immediately. Only a tenant administrator can remove the consent itself.
It does not block changes
Audit records are read after the change has happened. Governax records changes; it cannot prevent one.
How this helps with audits
When an auditor asks who had access in Microsoft Entra ID and when it changed, the answer is a filtered view of the ledger rather than a folder of screenshots. Approvals are recorded for access requests raised with /governax in Slack. Filters combine tool, event type, actor and a date range, and the date range matches when the change happened in Microsoft Entra ID, not when Governax recorded it.
Because a baseline snapshot is taken when you connect, the record starts from who already had access, not only from the changes that followed.
Every event is appended to the entity's SHA-256 hash chain, and database triggers reject every update and delete. Anyone given read access to the entity, an auditor included, can re-run verification, which recomputes every hash and checks every link.
Verification proves that what was recorded has not changed. It cannot prove that everything that happened was recorded. Governax records the evidence; it does not map it to controls, perform the audit or export reports.
Questions
Microsoft Entra ID integration FAQ
Does Governax need write access to Microsoft Entra ID?
No. The four Microsoft Graph application permissions on the consent screen are all read-only. Governax never reads mailboxes, files or passwords, and it never writes to your directory.
Who has to approve the connection?
An administrator who can grant tenant-wide consent, which in practice means a Global Administrator or Privileged Role Administrator. Personal Microsoft accounts are excluded, because they have no directory and no audit log to read.
How often is Entra ID polled?
Every 10 minutes. The first poll backfills the previous 7 days, or as much as your tenant retains, and each later poll re-reads a 1-hour trailing window because Microsoft makes records queryable some minutes after they happen.
Does Governax store a secret for our tenant?
No. Consent is recorded on Microsoft's side against Governax's own app registration, and Governax mints short-lived tokens from it when it needs to read. The only thing stored on the connection is your tenant id, which is not a secret.
Can Governax import history from before we connected?
Only a little. The first poll reads back the previous 7 days at most, and only what your tenant still retains. The baseline snapshot then records who holds each directory role at connect time.
Other integrations
- SlackWorkspace membership, channels, external sharing and access requests
- GitHubOrganisation, team and repository access, branch protection
- OktaUsers, groups, app assignments and admin roles
- Google WorkspaceUsers, groups, admin roles and third-party app grants
- AWSIAM users, roles and policies, read from CloudTrail
- GitLabGroup and project membership, tokens and deploy keys
Connect Microsoft Entra ID and start the record.
Read the Microsoft Entra ID setup guide, compare plans, or start free with one entity.