Report who has access with Microsoft Entra

The Permissions part of an AI system records who can use it or administer it. With Microsoft Entra connected, KlaritiQ reads the Entra groups you pick for each AI system and records each one as a Permissions part, so a change in who has access shows up as a new version instead of waiting for someone to remember to update it.

This is separate from Connecting Microsoft Entra ID to KlaritiQ, which adds and removes people in KlaritiQ over SCIM. This connection does not provision anyone. It only reads group membership counts.

What KlaritiQ reads, and what it stores

KlaritiQ is read only here. It writes nothing to Entra. An Entra administrator gives it two read permissions for your tenant: to read groups, and to read group members.

For each group you pick, KlaritiQ keeps:

• the group's id and display name
• the role you gave it: can use the system, or can administer the system
• the number of members, counting people in nested groups (a nested group is not itself counted)
• a SHA-256 hash of the members' object ids, sorted, which changes when anyone joins or leaves even if the count stays the same
• when it was last checked and the last error, if any

It never stores a member's name or email address, and it does not keep the member ids themselves: they are read to count and hash, then dropped. The tenant id is kept after consent. KlaritiQ does not store an access token.

The recorded part looks like this: the group's name, with a version such as administrator, 14 members, followed by the first 10 characters of the hash. A group with more than 100,000 members is not counted, and the group shows the reason.

Connect Entra (an owner or admin)

Only an owner or admin of your KlaritiQ organization can connect it. The person who connects must also hold one of these Microsoft Entra roles: Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator. Without one of them, KlaritiQ will not connect the tenant and says an Entra administrator must connect. A Microsoft Entra tenant can be connected to only one KlaritiQ organization.

1. Go to Integrations in the admin menu. Under Workspace connections find Microsoft Entra permissions, then choose Show details. If the card says Not enabled, Microsoft Entra permissions have not been switched on for your KlaritiQ workspace yet. Contact support and we will switch it on.
2. Choose Connect Entra. You are taken to Microsoft's own consent screen.
3. An Entra administrator reviews and approves the permissions. Microsoft words them in its own way: they come down to reading groups and reading group members, with no write access.
4. You are asked to sign in to Microsoft once more, to the same tenant. KlaritiQ uses that sign-in to confirm which tenant consented and that you hold one of the roles above, so use an account that belongs to the tenant. A guest account cannot connect it.
5. You are brought back to KlaritiQ and the card shows Connected with your tenant id.

If the consent is declined, or the sign-in is for a different tenant, the card says so and nothing is connected. If the tenant is already connected to another KlaritiQ organization, the card says This tenant is already connected and nothing changes here. If consent was recorded but groups still cannot be read, ask an Entra administrator to consent again.

Pick the groups for each AI system

1. On the Microsoft Entra permissions card, under AI system, choose an initiative.
2. Type part of a group's name and choose Search. The search shows up to 20 groups.
3. Choose a role, Can use the system or Can administer the system, then choose Add next to the group.

You can pick up to 10 groups for each initiative. You can change a group's role or choose Remove at any time. KlaritiQ reads the group when you add it, so when the AI system already has a recorded version the Permissions part appears right away. Only owners and admins can search, add, change or remove groups.

When it checks

KlaritiQ checks every 6 hours, and also when an admin adds, changes or removes a group or chooses Check now on the card. The check is not instant: a change in Entra appears at the next check.

If a check records nothing new, no new version is created. If the number of members or the members themselves changed, the AI system gets a new version with a changed Permissions part. Sign-offs that covered the Permissions part then need to be reviewed again, like any other change to a part.

Why a group may not be in the version yet

A group that is picked but not in the system version shows Not in the system version and the reason under its name:

• Waiting for the AI system to have a first version. Entra groups are added from the next recorded version on. KlaritiQ does not start a system's version history. Record a first version of the AI system, and the group is added at the next check.
• Another source already reports a permissions part with this name, so KlaritiQ leaves that part as it is. A part with the same name that a pipeline, an agent or a person recorded is never overwritten. Rename the Entra group, or remove that part from the system, if you want Entra to report it.
• Belongs to the previous Entra tenant, so it is no longer read. Remove it, or pick the group again from this tenant. See the section on connecting a different tenant below.

If a group is deleted in Entra, the part is recorded as deleted in Entra and the group shows Deleted in Microsoft Entra. If one group cannot be read in a check, the reason is shown on that group and its last recorded part stays as it was: a failed read never removes access from the record.

Other Permissions parts, such as one a pipeline or a person recorded, are kept as they are. KlaritiQ only manages the parts that came from Entra. A deploy push from a pipeline, a manifest or a coding agent does not remove the parts Entra reports; to remove one, remove the group in KlaritiQ. Near the limit of 40 parts a deploy may be recorded without some Entra parts, and its change note names what was left out. A person saving the AI system form records exactly what they sent.

Connect a different tenant

If you disconnect and later connect a different Entra tenant, the groups picked under the old tenant are not read any more and are not reported as deleted. They stay in the list marked as belonging to the previous tenant. Remove them, or pick the same groups again from the new tenant. Parts already recorded stay in the version history.

Disconnect

An owner or admin can choose Disconnect on the card. Checking stops and KlaritiQ forgets the tenant id. Nothing is deleted in Entra. Picked groups and every recorded version are kept, and reconnecting resumes the checks. To withdraw KlaritiQ's access fully, an Entra administrator also removes KlaritiQ from Enterprise applications in Entra.

When something is not working

• Consent needed: Entra withdrew consent or the app was removed. An admin chooses Consent again and an Entra administrator approves it.
• An Entra administrator must connect: the account you signed in with does not hold Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator. Ask a person who does to connect it.
• This tenant is already connected: the tenant belongs to another KlaritiQ organization. A tenant can belong to only one.
• Sign in as a member of the tenant: you signed in with a guest account. Use an account that belongs to the tenant.
• The sign-in did not match the tenant: sign in to the same tenant that gave consent.
• Checking paused: Microsoft asked KlaritiQ to slow down. Checking resumes by itself.
• A group is missing from the search: search by part of its display name. Only groups your Entra tenant returns can be picked.

What this does not do

• It does not show who is in a group. Only the count and a fingerprint are kept.
• It does not change anything in Entra, add anyone to a group or give anyone access.
• It does not look at application-level roles or at access outside the groups you picked.
• It does not check on your behalf that the groups you picked are the right ones for the system.

For what each connection can access and how credentials are protected, see How KlaritiQ Integrations Work. For what is sent to Microsoft, see the Sub-processors page.

Was this article helpful?

Community Questions (0)

Still have questions?