Ketch
Get a Demo

Ketch and Microsoft Entra

Discover which SaaS applications an organization actually uses, by reading the same registry Microsoft Entra already maintains for identity and access management.

Get a DemoGet Started Free
Microsoft Entra Integration Documentation

Microsoft Entra

About Microsoft Entra

Microsoft Entra ID manages authentication, SSO, and access across Microsoft 365, Azure, and thousands of third-party SaaS applications. Because so many applications get connected through Entra for single sign-on, its own application registry is one of the most reliable places to find systems a privacy program hasn't mapped yet, shadow IT included.

Ketch connects to Microsoft Entra to read that registry directly.

Capabilities

How Ketch works with Microsoft Entra

The Ketch Microsoft Entra integration covers System Discovery.

Discovery

Scans Microsoft Entra for personal data using the connected credentials. Connection requires registering a dedicated application in the Microsoft Entra admin center, configured for single-tenant access with OAuth authentication, and granting it the `Application. Read. All` Microsoft Graph permission, specifically application-level (not delegated) access. That permission lets Ketch read every application registration in the tenant, surfacing which systems are actually connected through Entra.

With Ketch, teams can

  • Discover SaaS applications connected through Microsoft Entra, including systems a privacy program might not have manually mapped
  • Connect with a precisely scoped Microsoft Graph permission (`Application. Read. All`), rather than broader tenant access
  • Feed discovered systems directly into Ketch's data inventory for further classification and coverage review

The gap

The problem this integration solves

Shadow IT, applications adopted by teams without going through a formal procurement or privacy review, is one of the hardest gaps for a privacy program to close through manual effort alone:

01. Manually maintaining a list of every SaaS application in use doesn't scale and misses tools adopted without a formal review

02. An identity provider like Entra already has a reliable record of connected applications, and not using that record means duplicating work Entra has effectively already done

03. Broad tenant-level access for a discovery tool creates unnecessary security exposure compared to a precisely scoped permission

Ketch resolves this by reading Entra's own application registry directly, using a precisely scoped Microsoft Graph permission rather than broad access.

Why Ketch

Why teams choose Ketch for Microsoft Entra privacy compliance

Permissioning infrastructure that governs Microsoft Entra the same way it governs every other system in your stack — not a one-off connector bolted onto a banner.

  • Closes shadow IT gaps automatically

    Applications connected through Entra for SSO get surfaced without a manual audit finding them first.

  • Precisely scoped permission

    `Application. Read. All` at the application level is the only Graph permission required, not broader tenant access.

  • Backed by enforcement precedent

    Regulators increasingly expect businesses to prove technical enforcement, not just describe it on paper, the same underlying expectation that applies to knowing which systems actually process personal data across an organization.

Questions about the Microsoft Entra integration

Related reading

Expert insights for teams connecting Microsoft Entra

Browse the Blog

Integrations

Pre-built APIs with 1,000+ systems, apps, and models

Ketch ships connectors and SDKs so consent, rights, and policy flow into your CDPs, warehouses, ad platforms, and AI stack — without a custom data pipeline.

Browse All Integrations

See Microsoft Entra permissioning running end to end

Book a demo to walk through rights, consent, and preference orchestration on your stack — or start free and connect Microsoft Entra yourself.

Get Started Free

Get started in less than 5 min

Get a Demo