Finding the Integration

You now know what an integration is made of, what travels through it, and what expires. This chapter puts you in front of the portal. Three questions come first, in this order: Which tenant am I looking at? What am I allowed to see there? And where, exactly, is the integration? Most of this chapter's value is in avoiding wasted time: opening the wrong tenant, looking at the registration when the enterprise application is the problem, or trying to change something your role doesn't allow.

Step 1: Get Into the Right Tenant

Entra pages show whichever tenant (directory) you are currently signed in to. Microsoft's guidance is that if you have access to more than one tenant, you use the Settings icon in the top menu of the admin center to switch to the one you want. A support engineer who works with many clients can easily end up in the wrong one, and every screen looks plausible. After switching:

1. Open Entra ID > Overview > Properties (Chapter 1) and compare the tenant ID with the one on your tenant card.
2. Note the tenant's domain name, so it is clear in any screenshot you take.

Step 2: Know What You Are Allowed to See

A support engineer from a vendor is not an administrator of the client's tenant, and shouldn't be. There are three realistic situations, and Microsoft's documentation describes what each can see.

A. You sign in as a guest (a B2B guest user)

Guests have limited default permissions. Microsoft states that by default a guest can manage their own profile and retrieve some information about other users, groups and apps, but cannot enumerate all users, groups or other directory objects. In the table of default permissions, both default and restricted guests can read properties of registered and enterprise applications and list permissions granted to applications. That is useful: it is a fair amount of what you need to look. Two cautions:

• Guests can be added to administrator roles, which then grant full read and write permissions for that role. So "guest" tells you the starting point, not the limit.
• The tenant may restrict guests further, and a setting called Restrict access to Microsoft Entra administration portal can stop non-administrators loading a set of frequently visited admin pages. Microsoft says it is not a security measure and most pages are still reachable by a direct link, but it can make the portal look half empty.

B. You are given a role

Microsoft's "least privileged roles by task" page lists, for each job, the smallest role that can do it. The rows that matter here:

A role that fits most diagnosis is Reports Reader for the logs and recommendations, together with the default ability to read application configuration. Global Reader is a broader read-only role, and Microsoft's own tenant-ID instructions use it as the minimum for viewing the Properties page. The principle in Microsoft's SSO planning page is to always use the role with the fewest permissions that does the job, and to remove roles that were only needed temporarily. Clients may also give you a role through Privileged Identity Management, which grants a role just-in-time for a limited period.

C. The client's administrator drives, and you watch

In practice this is the most common and the safest. The administrator opens the pages, you read the values over a screen share or from screenshots, and nothing is shared except what you need. Everything in this chapter works that way: you just need to know which page to ask them to open.

Step 3: Find the Application

There are two lists, one for each object from Chapter 2. Both are searchable by name; the Application (client) ID is the most reliable thing to search for, because names can be duplicated (Microsoft notes you can have several registrations with the same name).

You can jump between the two. On the registration's Overview page there is a link, Managed application in local directory, to the corresponding service principal in the same tenant. If the client can't find the registration at all, that is informative: in arrangement A it is simply in your tenant, not theirs.

Step 4: Read the App Registration

This page answers "how is the application defined, and what does it hold?" The sections that matter, from Microsoft's documentation:

Step 5: Read the Enterprise Application

This is the tenant-local face of the integration and the place where the quietest causes hide. Open Properties first. Microsoft documents these settings:

Then check the other sections, many of which later chapters expand:

Owners: the person who knows

An owner of an enterprise application can manage its tenant-specific configuration (single sign-on, provisioning, user assignments) and add or remove other owners, and, unlike an Application Administrator, only for the applications they own. The same is true of owners of app registrations. The Owners page is often the quickest route to the person who set the integration up. Two caveats from Microsoft: if Restrict access to Microsoft Entra administration portal is on, non-administrator owners can't use the admin center to manage their apps, and owners added through Graph or PowerShell (not the portal) can't manage some SAML settings such as attributes and claims or the certificate properties.

The Five-Minute Inspection

A repeatable order, so nothing is missed. Write the answers on the tenant card from Chapter 1.

1. Right tenant? Compare the tenant ID. Note the domain.
2. Find both objects. The registration (in whichever tenant owns it) and the enterprise application (in the client's). Search by client ID. Note both object IDs.
3. Enterprise application Properties. Is "Enabled for users to sign in" Yes? Is "Assignment required" Yes, and if so is the affected user assigned? Anything in Notes?
4. Credentials. On the registration, Certificates & secrets: what is there, and what expires when? For SAML, the certificate status and expiry. Today's date against each.
5. Configuration against your system. Client ID, redirect URIs (exactly), the SAML Identifier and Reply URL, certificate thumbprints: do the two sides agree?
6. Permissions and consent. Are the requested permissions granted? (Chapter 6.)
7. Provisioning, if relevant: its status, any quarantine message, when it last ran.
8. Evidence. Then the logs (Chapter 7), with the time of the failure and the correlation ID from the error (Chapter 3).

What to Ask the Client's Administrator For

Give them a short, specific request, say why you need it, and keep it to what you need. A model structure, filled in with the pages from this chapter:

Hands-On Exercises

All three use fictional organisations and values. Never put real secrets, tokens or tenant details into practice notes.