Policies for Entra ID
AI summary
Rencore provides policy templates for Entra ID organized into Security and Operations categories. Security policies identify risky settings, weak credentials, and overly broad access, while Operations policies check day-to-day hygiene including naming, ownership, and configuration. Each policy flags violations with a severity level, and templates marked as Recommended are good starting points.
These are the policy templatesPolicyA policy is a governance rule that Rencore Governance checks against your inventory, for example Teams without owners.Read more for Entra IDMicrosoft Entra IDMicrosoft Entra ID, formerly Azure Active Directory, is the Microsoft identity service behind every Microsoft 365 tenant.Read more, grouped by what they look for. Each template checks one kind of object and flags every item that breaks the rule. The severity shows how serious a violation is; a Recommended pill marks the templates Rencore recommends you start with.
See the Entra ID inventory reference for the objects these templates work on.
Security 5
Risky settings, weak credentials and access that is wider than it should be.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Enterprise applications using Exchange Web Services (EWS) Recommended | This policy detects app registrationsApp registrationAn app registration is the global definition of an application in Microsoft Entra ID.Read more in Microsoft Entra ID with the EWS.AccessAsUser.All delegated API permission… | High | Enterprise application |
| Enterprise applications that use SharePoint Online permissions | Shows Enterprise applicationsEnterprise applicationAn enterprise application is the local instance of an app in a Microsoft Entra tenant, its service principal, where admins control who can sign in and which permissions it holds.Read more that use SharePoint Online permissions. | Information | Enterprise application |
| Enterprise applications with full control or write permissions | Shows Enterprise applications with permissions that contain the words FullControl or Write. | Medium | Enterprise application |
| Risky sign-ins | Shows Sign-Ins with risk state "At Risk". | High | Risky Entra ID sign-in |
| Enterprise applications that use Microsoft Graph permissions | Shows Entra ID apps that use Microsoft GraphMicrosoft GraphMicrosoft Graph is the Microsoft API that gives access to the data of the Microsoft 365 services.Read more permissions. | Information | Enterprise application |
Operations 9
Day-to-day hygiene: naming, ownership, settings and configuration.
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Applications with client secrets that are about to expire | Shows Entra ID applications where client secretsClient secretA client secret is a password-like string that an app registration uses to prove its identity when it requests a token from Microsoft Entra ID.Read more expire in the next 30 days. | High | Application registration |
| Applications with expired certificates | Shows Entra ID applications with expired certificates. | High | Application registration |
| Applications with expired client secrets | Shows Entra ID applications with expired client secrets. | High | Application registration |
| Application registrations without owners | Shows Application registrations without any owners. | Medium | Application registration |
| Enterprise applications without owners | Shows Enterprise Applications without owners (excluding first-party Microsoft apps). | Medium | Enterprise application |
| Enterprise applications (SharePoint add-ins) with certificates or client secrets | Shows Enterprise applications with certificates or client secrets. | Medium | Enterprise application |
Show 3 more policies
| Policy | Description | Severity | Checks |
|---|---|---|---|
| Applications with certificates that are about to expire | Shows Entra ID applications where certificates expire in the next 30 days. | High | Application registration |
| Devices with disabled user accounts | Shows devices with disabled owners or user accounts. | Medium | Device |
| Enterprise applications (SharePoint add-ins) with expired certificates or client secrets | Shows Enterprise applications with expired certificates or client secrets. | Medium | Enterprise application |
Frequently asked questions
How many built-in policies does Rencore Governance provide for Entra ID?
How many built-in policies does Rencore Governance provide for Entra ID?14 built-in policies, such as Applications with client secrets that are about to expire, Applications with expired certificates and 12 more.
How are the Entra ID policies grouped?
How are the Entra ID policies grouped?By category: Security and Operations.
Which Entra ID policies are recommended?
Which Entra ID policies are recommended?Enterprise applications using Exchange Web Services (EWS).
Which module includes the Entra ID connector?
Which module includes the Entra ID connector?The Entra ID connector is part of the Digital Workplace module of Rencore Governance, which every Plan includes. The connector is generally available.