Set up a Microsoft 365 / Entra account
Register the read-only Entra app Valkan uses, then connect and scan the tenant.
Complete these steps in the Microsoft Entra admin center for the tenant Valkan will scan, before choosing Connect Microsoft 365 / Entra in Valkan. You need permission to register an app and grant admin consent — a Global Administrator, or an Application Administrator paired with someone who can grant admin consent (a Cloud Application Administrator or Global Administrator).
Valkan authenticates as its own tenant-wide app registration (app-only, client-credentials), not as a signed-in user. It never creates, changes, or deletes anything in Entra or Microsoft 365.
1. Register an app
In the Entra admin center, go to App registrations → New registration. Name it (e.g. valkan-discovery), leave it single tenant, and register.
2. Create a client secret
On the app's page, go to Certificates & secrets → Client secrets → New client secret. Copy the secret's value immediately — Entra shows it once. You'll also need the Application (client) ID and Directory (tenant) ID from the app's Overview page.
3. Grant the read-only Graph permissions
Go to API permissions → Add a permission → Microsoft Graph → Application permissions, and add each of these:
User.Read.AllGroup.Read.AllDevice.Read.AllDirectory.Read.AllApplication.Read.AllAuditLog.Read.AllIdentityRiskEvent.Read.AllSites.Read.AllTeamsAppInstallation.Read.All
Then click Grant admin consent for <tenant>. Every permission here is application (tenant-wide), not delegated — nothing requires a signed-in user.
4. (Optional, preview) Assign the AI reader role for Copilot agent inventory
Copilot Studio / Microsoft 365 Copilot Agent Builder agent inventory is a preview capability, not yet verified working end-to-end. It uses a different Microsoft API (Power Platform, not Graph) with a different authorization model — a directory role assignment, not an app permission — and in current testing, that API call has failed even with the role assigned. Everything else Valkan scans is unaffected either way; skip this step until this capability is confirmed.
If you want to try it anyway: go to Roles and administrators → AI reader → Add assignment, and search for the app you registered in step 1 by its client ID (not its display name — the search only matches service principals by ID here).
5. Connect and scan in Valkan
In Valkan, choose Integrations → Sources → Connect → Microsoft 365 / Entra, paste the Tenant ID, Client ID, and Client Secret from steps 1–2, and click Connect.
What your Microsoft 365 / Entra plan affects
Directory data, audit logs, SharePoint/OneDrive sharing, and Teams app installations all work on Entra ID Free — the tier every Microsoft 365 plan includes, down to Business Basic. Two things need more: sign-in activity (the last-sign-in/sign-in-count rollup) and sign-in risk detections both require Entra ID P1 or P2 (P1 gives limited access to risk detections, P2 full). Without P1/P2, both signals show as a permission gap, not an empty or silently missing result — everything else scans normally regardless of plan tier.