KeySkopeReviewed 2026-09-18
Preview: implemented and tested with fixtures; real-tenant acceptance testing is still required.
Before you start
- A Microsoft Entra workforce tenant in the global Microsoft cloud.
- An administrator authorised to register applications and grant the requested application permissions.
Read-only permissions
| Setting | Purpose / value |
|---|---|
| User.Read.All | Read users and account status. |
| RoleManagement.Read.Directory | Read directory roles and their direct members. |
Connect Microsoft Entra ID
- In Microsoft Entra admin center, open App registrations and register a single-tenant app named KeySkope read-only.
- Record Directory (tenant) ID and Application (client) ID.
- Under API permissions → Microsoft Graph → Application permissions, add User.Read.All and RoleManagement.Read.Directory. Remove unused permissions; do not add ReadWrite permissions.
- Have an authorised administrator grant tenant consent to those two permissions.
- Create a client secret with an expiry allowed by your organisation. Copy its value, not its identifier.
- Enter the three values in KeySkope and run a sync. Compare a member, guest and direct role assignment before relying on the preview.
Connection fields
| Setting | Purpose / value |
|---|---|
| directory_id | Directory tenant UUID. |
| client_id | Application client UUID. |
| client_secret | Secret value, with a tracked expiry date. |
What appears in KeySkope
- Users, guests, account-enabled status and direct user membership in activated directory roles.
- This preview is an account source. It does not replace your identity authority or collect groups, PIM eligibility, group-derived roles, M365 content or sign-in history.
Verify the first sync
- Wait for the sync to finish and review its status and any partial-collection notes.
- Compare the same account population in both systems. Check an account identifier, status and assigned role—not just the total.
- For a controlled test account, change its access in the source, sync again and verify the result. Keep approvals in your normal process.
- Record the credential owner and expiry. Rotate the credential in the source, update KeySkope and verify another sync before retiring the old credential.
Troubleshooting
| Setting | Purpose / value |
|---|---|
| 403 | Verify application permissions and tenant admin consent; delegated permissions are a different permission type. |
| Invalid client | Verify tenant/client IDs and secret value, including expiry. |
Official references
Vendor documentation reviewed on 2026-09-18. Setup has been checked against the connector implementation. A documentation review is not a live validation of every plan or tenant.
Ready to connect?
Open Connectors in your KeySkope workspace. Enter credentials only in the authenticated connection form.
Use your organisation’s dedicated KeySkope URL from an allowed network. Your workspace administrator can provide the address.