Documentation › Inventory
Active Directory and Entra ID
Steward IT Census can read your on-premises Active Directory over LDAP and your Microsoft Entra ID (Azure AD) tenant through Microsoft Graph, and combine both with the inventory. Configure them under Scanning › Active Directory & Entra ID. For Entra ID see below.
What is synced#
| Object | Details |
|---|---|
| Users | Account name, UPN, display name, email, title, department, office, phone, manager, OU, enabled / locked out, last logon, password last set, created, group memberships |
| Groups | Name, description, OU, type and scope, members |
| Computers | Name, DNS name, OS and version, OU, description, enabled, last logon |
Computer OUs and descriptions are copied onto matching assets (by host name), so you can browse assets by OU in the Assets left panel.
Operating system for computers Census hasn't inventoried yet. A computer found only by a network scan or passive discovery has no operating system until the Census agent or a WinRM login inventories it. When an enabled Windows computer with the same name (or DNS name) is in Active Directory or Entra ID, Census takes its operating system and build from there and sets the asset type to Windows or Windows Server; the asset's history shows OS from Active Directory: …. This happens after every sync and as soon as a scan finds the computer. An inventory always replaces it, a type you set by hand stays, and an OS given in a CSV import stays. When two directories list the same name with different operating systems, Census leaves the asset alone. The directory has no update level, so vulnerability checks still wait for a real inventory. User details appear in the Users section and next to each computer's logon history.
Setting it up#
- Scanning › Credentials › Add credential of type Active Directory (LDAP bind). Any domain user works; no admin rights are needed.
- Scanning › Active Directory & Entra ID › Add Active Directory domain:
| Field | Example |
|---|---|
| Domain name | corp.local |
| Domain controller | dc01.corp.local (or an IP) |
| Base DN | optional, derived from the domain name (DC=corp,DC=local) |
| Connection security | StartTLS (389), LDAPS (636) or None (not recommended) |
| Sync schedule | e.g. Daily |
| Also scan AD computers | Scans enabled computers that logged on in the last 90 days, using their DNS names. Handy when you don't want to maintain IP ranges. |
- Click Sync now. The status column shows how many users, groups and computers were read, or the error.
If the domain controller's certificate comes from an internal CA the server doesn't trust, enable Skip TLS verification on the LDAP credential.
Domain controller at another site: when the server can't reach it but a remote scanner at that site can, choose that site under Domain controller reached from.
Where you see AD data#
- Users: all users, combining AD accounts with users seen logging on to computers. Open a user to see their AD details, group memberships, the computers they use and the assets assigned to them.
- Users › AD groups: click a group to see its members: users (with display name, email, department and whether the account is enabled; click one for the user's page), nested groups (click to open them) and computers (linked to their asset when inventoried), and the groups it is a member of. Members Census has no record of, such as built-in accounts or accounts in another domain, are listed as Not synced.
- Users › AD computers.
- Assets left panel: assets grouped by OU.
- Reports:
- AD users not logged on for 90 days
- AD computers not logged on for 90 days
- AD computers never inventoried
- Unauthorized administrators (members of Domain Admins, Enterprise Admins and other privileged groups)
- Computers with a broken domain trust: see Repairing a computer's domain trust
Microsoft Entra ID#
Entra ID users, groups and devices land in the same lists as Active Directory ones (Users, AD groups, AD computers, the reports), with the OU shown as Entra ID.
| Object | Details |
|---|---|
| Users | Display name, UPN, email, job title, department, office, phone, manager, enabled, created, password last changed, last sign-in (see below), group memberships |
| Groups | Name, description, type (Security, Microsoft 365, Distribution, dynamic), user members |
| Devices | Name, OS and version, join type (Entra joined, Hybrid joined, Entra registered), compliance, last sign-in |
| Azure virtual machines (optional) | Added as assets: name, IP and MAC addresses, OS, and on the asset page Runs on: Azure with subscription, resource group, region, size (vCPUs, memory) and power state (on, off = stopped but still billed, deallocated). They merge with the same VM's agent or scan inventory (by MAC address or name). Each VM uses a license slot, so this is off by default. Report Azure virtual machines (Virtualization). |
| Intune devices (optional) | Added as assets: name, serial number, manufacturer, model, OS, primary user, MAC addresses, compliance. They merge with the same computer's agent or scan inventory (by serial number, MAC or name), and phones and tablets become Mobile Device assets. Each one uses a license slot, so this is off by default. |
Setting it up#
In the Entra admin center › App registrations, create a New registration (single tenant, no redirect URI). Copy the Application (client) ID and the Directory (tenant) ID.
Certificates & secrets › New client secret; copy the value (it is shown once) and note when it expires.
API permissions › Add a permission › Microsoft Graph › Application permissions:
User.Read.All,Group.Read.All,Device.Read.All(required)AuditLog.Read.Allfor last sign-in times (also needs an Entra ID P1 or P2 license)DeviceManagementManagedDevices.Read.Allfor Intune devicesOrganization.Read.All(orDirectory.Read.All) for Microsoft 365 licenses
Then click Grant admin consent.
For Azure virtual machines (optional): in the Azure portal, open each subscription (or a management group above them) › Access control (IAM) › Add role assignment, choose Reader and assign it to the app registration. The sync reads only the subscriptions the app can see.
Scanning › Credentials › Add credential of type Microsoft Entra ID: the application (client) ID and the client secret.
Scanning › Active Directory & Entra ID › Add Entra ID tenant: the tenant ID (or the primary domain, e.g.
contoso.onmicrosoft.com), the credential and the schedule; tick Intune, Azure virtual machines and/or Microsoft 365 licenses if wanted, then Sync now.
Missing optional permissions don't stop the sync: the status says which data needs which permission. Client secrets expire (after 6 to 24 months): renew the secret in Entra ID and update the credential before then, or the sync stops with a sign-in error.
Hybrid environments#
When users are synchronized from on-premises AD to Entra ID (Entra Connect), they would appear twice. By default the Entra ID sync leaves out users synced from on-premises AD, so add the AD domain for those; tick Also list users synced from on-premises AD if you don't sync the AD domain itself. Cloud-only users always appear.
Signing in with AD accounts#
Synced Active Directory accounts can also sign in:
- to Steward IT Census itself, with the role given by their AD groups: see Active Directory sign-in;
- to the help desk user portal, to submit and follow their requests.
Both check the password with your domain controller and need the domain to use StartTLS or LDAPS.