Microsoft Entra ID auditing help
Frequently asked questions
Clear answers about connecting Microsoft Entra ID, collecting evidence, verifying changes, and operating IAMCastle Auditor securely.
What does IAMCastle Auditor collect?
IAMCastle captures Microsoft Entra ID audit activity and directory evidence for users, groups, devices, applications, roles, Conditional Access policies, and tenant settings.
Which Microsoft Graph permissions are required?
IAMCastle requests tenant-wide read-only permissions: AuditLog.Read.All, Directory.Read.All, Policy.Read.All, and Application.Read.All. It does not request permission to change your Microsoft tenant.
How often is Microsoft Entra ID data collected?
Connected tenants are polled automatically every five minutes. Customer administrators can also request an immediate poll from Settings when they need fresh evidence.
How will I know if evidence collection stops?
IAMCastle monitors every scheduled poll. After five consecutive failed polls, it emails every active Admin user and any additional alert address configured in Settings under Notifications. A recovery email is sent when collection resumes, and isolated failures that recover before the threshold do not trigger an alert.
How are old and new values produced?
IAMCastle retains independent directory snapshots and compares each new state with the previous stored state. The resulting change is presented in plain English rather than raw Microsoft Graph JSON.
Why does IAMCastle group multiple Microsoft records into one change story?
Microsoft Entra ID can emit several audit or snapshot records for one real-world action, such as creating a user, provisioning an application, or changing a policy. IAMCastle correlates those records into one readable evidence story with the highest risk, complete before-and-after attributes, why it matters, and what to verify. Every original record remains retained and available for forensic investigation and hash-chain verification.
Can IAMCastle evidence be verified?
Yes. Each evidence record includes its own SHA-256 hash and the previous record hash, forming a tenant-specific chain that exposes missing or altered records.
How is customer data separated?
Every request is authorised against the signed-in user and customer tenant. Evidence, directory objects, exports, and administration are scoped to that customer before data is returned.
What is included in the free and paid plans?
Free customers can view today's changes while older retained evidence remains locked. A paid subscription unlocks historical evidence, verification, search, and exports.
Do I need to install software or maintain a server?
No. IAMCastle is an entirely cloud-based SaaS service. Customers connect Microsoft Entra ID through Microsoft admin consent and use IAMCastle in their browser.
How does Microsoft SSO work?
The first customer administrator enables Microsoft OpenID Connect during onboarding. Approved users then sign in with their own organisation identities; IAMCastle does not create or retain customer passwords.
What are break-glass account alerts?
Customer administrators can select emergency-access identities from the connected Entra directory. Captured changes to the protected user or its group memberships, plus successful and failed interactive sign-ins, are promoted to critical for immediate review. Sign-in monitoring requires a Microsoft Entra licence that provides sign-in logs through Graph.
Can alerts go to an additional mailbox?
Yes. In Settings, an administrator can add a notification address such as a security operations mailbox alongside active IAMCastle administrators.
Where is customer evidence stored?
UK storage is the standard deployment. EU and US data-region options are available by arrangement; contact hello@iamcastle.io to discuss residency requirements.
Can reports be scheduled?
Yes. IAMCastle includes built-in lifecycle, group, privileged-access, application, Conditional Access, risk, and directory-health reports. Reports can run immediately or be delivered on a daily, weekly, or monthly schedule as XLSX.