Configuring Microsoft Entra ID

To integrate Microsoft Entra ID in Central NAC, do the following:

Register Central NAC in Entra ID Portal

Register the Central NAC application in Entra ID to authenticate with the Microsoft identity platform endpoint. This configuration allows the Central NAC application to call Microsoft Graph APIs to authorize users during authentication.

For instructions, see Register an application with the Microsoft identity platform.

In the Redirect URI section, add OAuth and Reply URLs of the Cloud Guest server. The reply URL must be in the https://<cloud guest server>/oauth/reply format.

Configure API Permissions

After registering the application, you must configure the following API permissions to call APIs:

• Directory.Read.All
• Group.Read.All
• User.Read
• User.Read.All

In the Entra ID portal, for the registered Central NAC application, ensure that the API permission type is selected as Application permissions in the API permissions > Add a permission > Microsoft Graph.

For more information, see Introduction to permissions and consent section under Permissions and access in the Microsoft Entra ID portal.

After adding the API permissions, ensure to grant admin consent for all API permissions. To do this, select Grant admin consent in the API Permissions page. You must have administrator rights to grant admin consent.

Configure Client Secret ID for Central NAC

The client secret is a text value and is used to identify the Central NAC application when requesting an access token from the Microsoft identity platform token endpoint. The access token is then used in the Microsoft Graph API to get information about users.

For more information, see Add a client secret.

The Value and Secret ID are generated for the client. Ensure to note down these values to use in the Cloud Authentication and Policy application. This secret value is never displayed again after you leave this page.

APIs for Microsoft Entra ID

The following APIs are used by Central NAC to authorize users in Microsoft Entra ID:

• GET https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}

• GET https://graph.microsoft.com/v1.0/users/{id | userPrincipalName}/memberOf