Securing Azure
One client secret holding Sites.FullControl.All can read and change every SharePoint site in your tenant. An administrator grants that with one click, the wizard accepts it, and Test Connection goes green either way. This section is how the IT team or managed service provider running your Azure keeps that secret, and everything around it, as small as the job allows, and then proves it.
This page applies to every customer who connects a Microsoft system. If Demiton runs in your own Azure subscription, Azure in your own subscription applies too. Auditing Azure checks both with read-only commands.
Read the diagram top to bottom. Each arrow names what crosses the boundary, and how it authenticates.
YOUR ENTRA TENANT (every customer) Person ──── signs in, your MFA ────► Demiton sign-in app Connector ─ client secret ─────────► Connector app registration App reg ─── app permissions ───────► Graph, Dynamics
YOUR SUBSCRIPTION (dedicated deployment only) App ─────── password over TLS ─────► PostgreSQL App ─────── account key ───────────► Blob storage Browser ─── 15-minute signed link ─► Blob storage App ─────── API key ───────────────► Azure OpenAI App ─────── identity, AcrPull ─────► Container registry Deploy ──── AcrPush, Contributor ──► Registry and appsThe credentials in that diagram are the limits of what you can tighten today, because Demiton uses them as drawn. Where a control would break one, these pages say so.
Tenant baseline
Section titled “Tenant baseline”A stolen administrator session undoes every other control on this page, so start here.
| ID | Control | Setting | Licence |
|---|---|---|---|
| T1 | MFA for every person | Conditional Access requiring MFA for all users, or Security Defaults if you have no P1 | Free or P1 |
| T2 | Phishing-resistant MFA for administrators | Conditional Access authentication strength on every admin role | P1 |
| T3 | Legacy authentication blocked | Conditional Access block on other clients, already included in Security Defaults | Free or P1 |
| T4 | Few Global Administrators | Two to four, plus two monitored break-glass accounts excluded from Conditional Access | Free |
| T5 | Standing admin rights removed | Privileged Identity Management: roles eligible, activated for a time-boxed window with a reason | P2 |
| T6 | Users cannot consent to apps | User consent off, admin consent workflow on | Free |
| T7 | Users cannot register apps | Users can register applications set to No | Free |
| T8 | Guest invitations limited | Admins and Guest Inviters only | Free |
Connector app registrations
Section titled “Connector app registrations”Create one app registration per system, per environment. Business Central UAT and Business Central Production get separate registrations and separate secrets, so a leaked UAT secret cannot reach production. Make them single-tenant, name them so a stranger could tell what they do (demiton-bc-prod), and give each two named owners.
Expire every secret at 90 days. Connectors authenticate with a tenant ID, client ID and client secret. They do not support certificates or federated credentials today, so a short secret is your main defence. To rotate without an outage:
- Add a second secret to the app registration
- Paste it into the connector on the Systems page and run Test Connection
- Delete the old secret in Entra
Grant the least the job needs
Section titled “Grant the least the job needs”This is what each connector calls for:
| System | Grant | Leave out, and why |
|---|---|---|
| Business Central | Application access, with an Entra application record in BC carrying only the permission sets your workflows use (typically Jobs, Purchase, Vendor) | SUPER. See the Business Central guide |
| Finance & Operations | An Entra application record mapped to a user holding only the data entities you need | System administrator. See the F&O guide |
| Dataverse | An application user with a custom security role on the tables your workflows use | System Administrator. See the Dataverse guide |
| SharePoint, reading documents | Ask Demiton for the delegated sign-in route: Sites.Read.All, Files.Read.All, User.Read and offline_access, which reach only what the signed-in person can already open. For app-only, try Sites.Selected with a read grant on each site | Sites.FullControl.All |
| SharePoint, creating sites and libraries | Sites.FullControl.All, on its own app registration, used only by the project scaffolding workflows | Do not share this registration with the read connector |
| Shared mailbox | Mail.Read, limited to that mailbox with RBAC for Applications in Exchange Online | Unscoped Mail.Read, which reads every mailbox. Application Access Policies still work, but Microsoft now treats them as legacy |
| Entra ID, reading the directory | User.Read.All, Group.Read.All | The security audit and write permissions, until you run those workflows |
| Entra ID, workforce lifecycle | Add GroupMember.ReadWrite.All, and Group.ReadWrite.All if workflows create groups | User.ReadWrite.All: the HR-attribute update that needs it has no live caller |
| Microsoft Teams | The webhook delivery route, which needs no Graph permission | Graph permissions, unless you need direct messages. See the Teams guide |
Restricting connectors to known IP addresses is optional. Conditional Access for workload identities can block a single-tenant service principal from outside known IP ranges. It needs a Workload Identities Premium licence and a fixed outbound address. Run the policy in report-only mode first: if the outbound address changes while it is enforced, every connector under it stops.
Signing in to Demiton
Section titled “Signing in to Demiton”The sign-in app asks for openid, email, profile and User.Read. It needs nothing else, so any wider grant on it is a finding.
| ID | Control | Setting |
|---|---|---|
| S1 | Your Conditional Access covers Demiton | MFA policies target All resources, or name the Demiton enterprise app |
| S2 | Only the right people can sign in | Enterprise app → Properties → Assignment required set to Yes, assigned to a group |
| S3 | Leavers lose access at the source | Disabling the Entra account ends Microsoft sign-in. Remove the person in HQ → Users too |
| S4 | Dedicated deployment only: the app is yours | Single-tenant registration, with HTTPS redirect URIs on your own hostnames only |
Assignment required also applies to the Outlook add-in, so add its users to the same group.
Next steps
Section titled “Next steps”- Azure in your own subscription - only if Demiton runs in your subscription
- Auditing Azure - check the configuration with read-only commands
- Connection wizard - connect a system once Azure is ready
Talk to the team
Tell us what you run - your ERP, field, payroll and document systems - and we will show you the registers Demiton would fill from them, on your data, in a 30-minute call.