---
title: "Scan Microsoft Entra ID users | Lansweeper Classic"
slug: "scan-microsoft-entra-id-azure-ad-users-and-groups"
description: "Scan Microsoft Entra ID (Azure AD) users and groups with Lansweeper Classic, using a Microsoft Cloud Service credential and the Microsoft Graph API."
updated: 2026-06-17T09:31:18Z
published: 2026-06-17T09:31:18Z
canonical: "docs.lansweeper.com/scan-microsoft-entra-id-azure-ad-users-and-groups"
stale: true
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lansweeper.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Scan Microsoft Entra ID (Azure AD) users and groups

Lansweeper is capable of scanning Microsoft Entra ID (Azure Active Directory) users and groups using a scanning target. This scanning target makes use of the Microsoft Cloud Service credential type, which can also be used to scan your [Intune assets](/classic/docs/scan-mobile-devices-through-microsoft-intune) or [Microsoft 365 tenant](/classic/docs/scan-microsoft-365-targets). This credential makes use of Modern Authentication and the Microsoft Graph API, using application permissions.

> **Note:** Data scanned via Lansweeper Classic scanning targets is not synchronized to a linked Lansweeper Site. Additionally, AD users scanned via Classic do not reconcile with Microsoft Entra ID (Azure AD) users discovered by the [Cloud Scanner](/docs/what-is-cloud-discovery). Running both in parallel results in duplicate user records in your Site. To see your users enriched with Entra ID or M365 data in Lansweeper Sites, use [Network Discovery](/docs/what-is-network-discovery) combined with the Cloud Scanner instead.

## Prerequisites

To scan your Microsoft Entra ID (Azure AD) make sure that:

- You've already [set up your Microsoft Cloud Services application](/classic/docs/create-a-microsoft-cloud-services-application).
- You're in possession of your Microsoft Cloud Services application's Application (client) ID, Directory (tenant) ID, and Client secret or certificate. These are obtained when creating the application.

## Add permissions to the Microsoft Graph application

1. Open your company's Azure portal and go to **App registrations**.
2. Select the [the app you've already created](/classic/docs/create-a-microsoft-cloud-services-application), then select the **API permissions** tab.
3. Select **Add permission** then select **Microsoft Graph** from the API list.
4. As you're setting up the Microsoft Graph API to enforce modern authentication, you will need to add Application permissions. Select **Application permissions**.
5. Add the **Group.Read.All**, **GroupMember.Read.All** and **User.Read.All** API permissions. These are required to be able to scan all Microsoft Entra ID (Azure Active Directory) data. Once the permissions are added, select **Save** button and double-check the permissions listed.
6. Select **Grant admin consent for** and select **Grant** in the resulting pop-up. The added permissions should now show **Granted for** .

## Add a Microsoft Cloud Service credential

1. In Lansweeper, navigate to **Scanning > Scanning Credentials.**
2. Select **Add New Credential**.
3. In the Type dropdown, select **Microsoft Cloud Service**.
4. Enter a name for your credential.
5. Enter the Application ID and Directory ID that were created when you [created a Microsoft Cloud Services application](/classic/docs/create-a-microsoft-cloud-services-application).
6. For **Authentication type**, select either **Client secret** or **Certificate thumbprint**.
7. Enter the client secret or certificate thumbprint that was created when you [created a Microsoft Cloud Services application](/classic/docs/create-a-microsoft-cloud-services-application).
8. If you'd like a Microsoft Entra ID scan target to be automatically created, select **Microsoft Entra ID (Azure Active Directory)**. If you plan to use the same credentials for multiple scan targets, you can select those as well.
9. Select **OK**.

If you're using the Microsoft Cloud Service credential for multiple scan targets, ensure that the app has sufficient [API permissions](/classic/docs/create-a-microsoft-cloud-services-application#HowToScanAndMail) to scan the selected scanning targets. If you'd like to use the credential for both Microsoft 365 and Microsoft Entra ID (Azure Active Directory) scanning for example, make sure application permissions are set for both.

If you already have a Microsoft Cloud Services credential, you can add a new Microsoft Entra ID (Azure Active Directory) Scanning target to it via **Scanning > Scanning Targets**. During the creation of your Microsoft Entra ID (Azure Active Directory) scanning target, you can select a pre-existing credential.