Microsoft Entra ID and M365 SharePoint

​

What Oleria discovers

• Users and their profiles, including their authentication methods.
• Groups and group membership.
• Applications registered in your tenant.
• Directory roles and role assignments.
• Policies - conditional access policies, and entitlement management role assignments.
• Non-human identities - service principals and AI agents, with their credentials and permission grants.
• Identity risk events and audit log activity.
• SharePoint and OneDrive sites and the items in them, when you connect M365 SharePoint.

​

Prerequisites

• A Microsoft Entra ID account with the Global Administrator role, to grant the permissions below.
• Admin access on the Oleria platform to add a new integration.

​

Integration approaches

1. Connect with Microsoft OAuth - automated configuration. Oleria creates the app and requests consent for you.
2. Connect with a client secret - manual configuration with an app registration and client secret.
3. Connect with a client certificate - manual configuration with an app registration and certificate, for security policies that require certificate-based authentication.

​

Connect with Microsoft OAuth

1

Open the integration

Sign in to your Oleria workspace and select Integrations.

• Select Microsoft Entra ID to integrate Entra ID, or
• Select Microsoft SharePoint and OneDrive to integrate Entra ID, SharePoint, and OneDrive.

A side panel opens.

2

Choose permission scope

The screen shows an option to enable write permissions to allow Oleria to perform select remediations. The Oleria remediation feature is optional.To enable remediations, select the checkbox. Otherwise, select Authenticate to proceed with the standard read-only permissions scope.

3

Select your Microsoft account

Select your Microsoft account and complete authentication.

4

Complete the initial consent form

A consent form appears to grant permissions for the Oleria application to view your basic profile and read access. Complete the consent form by selecting Accept.

5

Complete the application consent form

Microsoft’s application consent form appears with a list of requested permissions, which varies depending on your selected application and whether you chose to enable optional remediation capabilities. Complete the consent form by selecting Accept.The permissions vary by integration type:

1. Standard read-only permissions for Entra ID integration (without optional remediations)
2. Standard read-only permissions for SharePoint and OneDrive integration (without optional remediation)
3. Permissions for Entra ID integration with optional remediation capabilities (includes some write permissions)
4. Permissions for SharePoint and OneDrive integration with optional remediation capabilities (includes some write permissions)

​

Connect with a client secret

1

Create an app registration in Entra ID

Sign in to Microsoft Entra ID, navigate to App registrations, and select New registration.

2

Configure the registration

Give a name to the application (for example, Oleria) and select Accounts in this organizational directory only (Single tenant). Select Register.

Oleria connects to one tenant per integration. To connect more tenants, create an app registration in each one, or register the app as Accounts in any organizational directory (Multitenant), grant admin consent in each tenant, and add a separate Oleria integration per tenant.

3

Open API permissions

Open the application and select Manage -> API permissions. Select Add permission.

4

Add Microsoft Graph permissions

Select Microsoft Graph and select Application permissions. Add the permissions appropriate for your integration:

1. Standard read-only permissions for Entra ID integration (without optional remediations)

API / Permissions name	Type	Permission
Microsoft Graph (15)
Agreement.Read.All	Application	Read all terms of use agreements
Application.Read.All	Application	Read all applications
AuditLog.Read.All	Application	Read all audit log data
Directory.Read.All	Application	Read directory data
EntitlementManagement.Read.All	Application	Read all entitlement management resources
Group.Read.All	Application	Read all groups
GroupMember.Read.All	Application	Read all group memberships
IdentityRiskEvent.Read.All	Application	Read all identity risk event information
LifecycleWorkflows.Read.All	Application	Read all lifecycle workflows resources
Policy.Read.All	Application	Read your organization’s policies
profile	Delegated	View users’ basic profile
RoleManagement.Read.Directory	Application	Read all directory RBAC settings
User.Read	Delegated	Sign in and read user profile
User.Read.All	Application	Read all users’ full profiles
UserAuthenticationMethod.Read.All	Application	Read all users’ authentication methods

2. Standard read-only permissions for SharePoint and OneDrive integration (without optional remediation)

API / Permissions name	Type	Permission
Microsoft Graph (16)
Agreement.Read.All	Application	Read all terms of use agreements
Application.Read.All	Application	Read all applications
AuditLog.Read.All	Application	Read all audit log data
Directory.Read.All	Application	Read directory data
EntitlementManagement.Read.All	Application	Read all entitlement management resources
Group.Read.All	Application	Read all groups
GroupMember.Read.All	Application	Read all group memberships
IdentityRiskEvent.Read.All	Application	Read all identity risk event information
LifecycleWorkflows.Read.All	Application	Read all lifecycle workflows resources
Policy.Read.All	Application	Read your organization’s policies
profile	Delegated	View users’ basic profile
RoleManagement.Read.Directory	Application	Read all directory RBAC settings
Sites.Read.All	Application	Read items in all site collections
User.Read	Delegated	Sign in and read user profile
User.Read.All	Application	Read all users’ full profiles
UserAuthenticationMethod.Read.All	Application	Read all users’ authentication methods
Office 365 Management APIs (1)
ActivityFeed.Read	Application	Read activity data for your organization
SharePoint (2)
Sites.FullControl.All	Application	Have full control of all site collections
Sites.Read.All	Application	Read items in all site collections

3. Permissions for Entra ID integration with optional remediation capabilities (includes some write permissions)

API / Permissions name	Type	Permission
Microsoft Graph (23)
Agreement.Read.All	Application	Read all terms of use agreements
Application.Read.All	Application	Read all applications
Application.ReadWrite.All	Application	Read and write all applications
AppRoleAssignment.ReadWrite.All	Application	Manage app permission grants and app role assignments
AuditLog.Read.All	Application	Read all audit log data
Directory.Read.All	Application	Read directory data
EntitlementManagement.Read.All	Application	Read all entitlement management resources
Group.Read.All	Application	Read all groups
Group.ReadWrite.All	Application	Read and write all groups
GroupMember.Read.All	Application	Read all group memberships
IdentityRiskEvent.Read.All	Application	Read all identity risk event information
LifecycleWorkflows.Read.All	Application	Read all lifecycle workflows resources
Policy.Read.All	Application	Read your organization’s policies
profile	Delegated	View users’ basic profile
RoleManagement.Read.Directory	Application	Read all directory RBAC settings
RoleManagement.ReadWrite.Directory	Application	Read and write all directory RBAC settings
User.DeleteRestore.All	Application	Delete and restore all users
User.EnableDisableAccount.All	Application	Enable and disable user accounts
User.Read	Delegated	Sign in and read user profile
User.Read.All	Application	Read all users’ full profiles
User.ReadWrite.All	Application	Read and write all users’ full profiles
User.RevokeSessions.All	Application	Revoke all sign in sessions for a user
UserAuthenticationMethod.Read.All	Application	Read all users’ authentication methods

Each remediation action checks for its own permission before it runs. Grant the permissions for the actions you plan to use:

Remediation action	Required permission
Enable or disable a user	User.EnableDisableAccount.All and User.Read.All
Add or remove a user from a group	Group.ReadWrite.All
Add or remove a user from a directory role	RoleManagement.ReadWrite.Directory
Assign or unassign a user or group to an application	AppRoleAssignment.ReadWrite.All
Disable a non-human identity (service principal)	Application.ReadWrite.All
Create a user	User.ReadWrite.All
Delete a user	User.DeleteRestore.All and User.ReadWrite.All
Revoke a user’s sign-in sessions	User.RevokeSessions.All

4. Permissions for SharePoint and OneDrive integration with optional remediation capabilities (includes some write permissions)

API / Permissions name	Type	Permission
Microsoft Graph (20)
Agreement.Read.All	Application	Read all terms of use agreements
Application.Read.All	Application	Read all applications
AuditLog.Read.All	Application	Read all audit log data
Directory.Read.All	Application	Read directory data
EntitlementManagement.Read.All	Application	Read all entitlement management resources
Files.ReadWrite.All	Application	Read and write files in all site collections
Group.Read.All	Application	Read all groups
Group.ReadWrite.All	Application	Read and write all groups
GroupMember.Read.All	Application	Read all group memberships
GroupMember.ReadWrite.All	Application	Read and write all group memberships
IdentityRiskEvent.Read.All	Application	Read all identity risk event information
LifecycleWorkflows.Read.All	Application	Read all lifecycle workflows resources
Policy.Read.All	Application	Read your organization’s policies
profile	Delegated	View users’ basic profile
RoleManagement.Read.Directory	Application	Read all directory RBAC settings
Sites.Read.All	Application	Read items in all site collections
User.EnableDisableAccount.All	Application	Enable and disable user accounts
User.Read	Delegated	Sign in and read user profile
User.Read.All	Application	Read all users’ full profiles
UserAuthenticationMethod.Read.All	Application	Read all users’ authentication methods
Office 365 Management APIs (1)
ActivityFeed.Read	Application	Read activity data for your organization
SharePoint (2)
Sites.FullControl.All	Application	Have full control of all site collections
Sites.Read.All	Application	Read items in all site collections

The SharePoint remediation action removes an external account’s access to a site or file. It uses a different permission depending on how that access was granted:

Access removed	Required permission
Sharing on a file or list item	Files.ReadWrite.All (Microsoft Graph)
Membership in the Microsoft 365 group behind a site	Group.ReadWrite.All (Microsoft Graph)
Membership in a classic SharePoint site group	Sites.FullControl.All (SharePoint)

5

Grant admin consent

After adding all application permissions, select Grant admin consent to complete the consent.

6

Confirm admin consent

After admin consent succeeds, each permission shows a green granted status.

7

Create a client secret

Navigate to Certificates & Secrets and create a client secret.

8

Copy the client secret value

The generated client secret will be shown. Copy the Client Secret Value.

9

Copy the client ID and tenant ID

From the app registration overview, copy the Application (client) ID and Directory (tenant) ID.

10

Open the integration in Oleria

Sign in to your Oleria workspace and select Integrations -> Microsoft SharePoint and OneDrive.A side panel opens.

11

Authenticate with a client secret

Select the Authentication Method dropdown and select Client Secret Authentication.Enter the Client Secret, Tenant Id, and Client Id you copied earlier. To enable remediation actions, also select I authorize Oleria to perform write actions in Microsoft Entra ID. Then select Authenticate.

​

Connect with a client certificate

1

Prepare your certificate files

Place the following files in a single working directory:

• certificate.pem - the public certificate in PEM format
• private_key.txt - the matching unencrypted private key in PEM format
• certificate_chain.txt - the intermediate certificate chain in PEM format

If your organization does not issue these files through an internal PKI, generate a self-signed certificate using the tooling of your choice (for example, AWS Certificate Manager Private CA or New-SelfSignedCertificate on Windows) and export it in the formats above.

The private key must be unencrypted. If private_key.txt is passphrase-protected, decrypt it to a new file with openssl rsa -in private_key.txt -out private_key_unencrypted.txt (or the equivalent for your key type). Keep the encrypted original, and use private_key_unencrypted.txt wherever the commands below reference private_key.txt.

2

Generate the base64-encoded private key

Oleria expects a single base64 string that decodes to the certificate, chain, and unencrypted private key concatenated as PEM blocks. Run the commands for your operating system from the directory that holds the files prepared in the previous step.

• macOS or Linux
• Windows (PowerShell)

cat certificate.pem certificate_chain.txt private_key.txt > generated_cert.pem
base64 < generated_cert.pem | tr -d '\n' > base64_generate_cert.pem

Get-Content certificate.pem, certificate_chain.txt, private_key.txt |
    Set-Content generated_cert.pem
[Convert]::ToBase64String([IO.File]::ReadAllBytes("generated_cert.pem")) |
    Set-Content base64_generate_cert.pem -NoNewline

The contents of base64_generate_cert.pem is the value you will paste into Oleria in the final step.

3

Upload the certificate to Entra ID

Sign in to your Entra ID tenant and navigate to Microsoft Entra ID -> Manage -> App registrations. Open your Oleria app registration.

If the app is not visible under Owned applications, switch to All applications and search for it by name.

Select Manage -> Certificates & secrets -> Certificates and upload certificate.pem.

4

Open the integration in Oleria

Sign in to your Oleria workspace and select Integrations.

• For a new integration, select Microsoft Entra ID or Microsoft SharePoint and OneDrive to open the side panel.
• To migrate an existing integration from client secret to client certificate, select Connected, then select the edit icon on your Entra ID integration to open the side panel.

5

Authenticate with the client certificate

From the Authentication Method dropdown, select Client Certificate Authentication.Provide the following:

Field	Notes
Tenant Id	Your Directory (tenant) ID from the app registration overview.
Client Id	Your Application (client) ID from the app registration overview.
Private Key	The contents of base64_generate_cert.pem from the previous step.

Select Update to save the integration.

6

Clean up generated files

generated_cert.pem and base64_generate_cert.pem both contain the unencrypted private key inline, as does private_key_unencrypted.txt if you decrypted a passphrase-protected key. Delete them from the working directory now that the integration is connected. Your original certificate.pem, certificate_chain.txt, and private_key.txt files are unchanged and can stay in your existing key store.

• macOS or Linux
• Windows (PowerShell)

shred -u generated_cert.pem base64_generate_cert.pem 2>/dev/null || \
  rm -P generated_cert.pem base64_generate_cert.pem

# Only if you decrypted a passphrase-protected key
shred -u private_key_unencrypted.txt 2>/dev/null || rm -P private_key_unencrypted.txt

Remove-Item generated_cert.pem, base64_generate_cert.pem -Force

# Only if you decrypted a passphrase-protected key
Remove-Item private_key_unencrypted.txt -Force

For a stronger overwrite guarantee on a spinning disk, run cipher /w:<directory> against the working directory from an elevated command prompt. On an SSD this is a no-op due to wear leveling.

If your shell records command history, clear it to remove references to the key file paths: history -c on Bash or Zsh, Clear-History on PowerShell.

​

How Oleria handles the private key

​

Verify the integration

​

Remediation actions

• Enable or disable a user
• Add or remove a user from a group
• Add or remove a user from a directory role
• Assign or unassign a user to an application
• Assign or remove a group’s access to an application
• Disable a non-human identity (service principal)
• Create a user
• Delete a user
• Revoke a user’s sign-in sessions

​

Check the Oleria app in your Entra ID instance

1

Find the Oleria app in Enterprise applications

Sign in to your Entra ID instance, navigate to Enterprise applications -> select All applications.You will find the Oleria application in the Enterprise applications list.

2

View granted permissions

Select Permissions to view the read permissions granted to the Oleria application.

​

Contact us