Credential Checks
Credential Checks let ShadowMap tell you which of your leaked employee credentials are still live — i.e. the password still authenticates against your Microsoft Entra ID (Azure AD) tenant — so your team can prioritise the working ones instead of triaging thousands of stale entries by hand.
You configure this once, under Settings → Credential Checks (owner/admin only), by giving ShadowMap an Entra app registration.
What you need to provide
Just three values from an Entra app registration:
- Client ID (Application ID)
- Client Secret
- Tenant ID (Directory ID — a GUID, or a verified domain)
That's it. No Microsoft Graph directory permissions are required.
Why no directory permissions?
The check uses the Resource Owner Password Credentials (ROPC) grant — it submits the leaked password straight to login.microsoftonline.com and reads Microsoft's response code. That tells us everything we need (works / wrong password / user doesn't exist / MFA-protected / locked / disabled) without the app ever reading your directory. So there is nothing to consent to beyond registering the app.
Setup
- In the Azure portal go to Microsoft Entra ID → App registrations → New registration. Give it a name (e.g. ShadowMap Credential Checks) and register it.
- Copy the Application (client) ID and Directory (tenant) ID from the app's Overview.
- Under Certificates & secrets → New client secret, create a secret and copy its Value (not the Secret ID).
- Under Authentication, make sure the app is allowed to use the resource-owner password flow (enable "Allow public client flows" if your tenant requires it for ROPC).
- In ShadowMap, open Settings → Credential Checks, paste the Client ID, Client Secret, and Tenant ID, and click Update Configuration.
- Click Test connection and confirm the Credentials check passes.
The "Test connection" button
Testing runs against your saved configuration and shows one or two results:
| Result | Meaning |
|---|---|
| Credentials — pass | The Client ID, Secret, and Tenant authenticate. You're ready. |
| Credentials — fail | Something is wrong with the app registration — the message tells you which (wrong/expired secret, wrong Client ID, wrong Tenant ID, or the app needs admin consent). |
| Active-user data — pass | Optional Graph permission is present; ShadowMap can also show which accounts are active/enabled. |
| Active-user data — warning | Optional Graph permission not granted. This is fine — the login check still works fully; you just won't get the extra "active user" data. |
Optional: active-user enrichment
If you also want ShadowMap to flag which of the matched accounts are currently active / enabled (and, with an Entra ID P1 licence, their last sign-in), grant the app these Microsoft Graph application permissions and click Grant admin consent:
User.Read.All— account exists / enabledAuditLog.Read.All(optional, needs Entra ID P1) — last sign-in time
This is purely additive. Leaving it out never blocks the credential check.
Common questions
Do we have to grant ShadowMap read access to our whole directory? No. The core check needs no directory permission at all. Directory read (User.Read.All) is optional and only powers the "active user" data.
The test says my secret is invalid. Client secrets expire. Create a fresh secret in Certificates & secrets and paste the new Value into ShadowMap.
The test says the app needs admin consent. A Global Administrator needs to consent to the app once in the Azure portal (Enterprise applications → your app → Permissions), or grant consent on the app registration's API permissions page.
Will this lock out our employees? No. Checks are rate-limited, de-duplicated, capped to a few attempts per user, and stop as soon as a result is known — well within Entra's Smart Lockout thresholds. Only credentials found in leaks are ever tested.
What does "active-user data — warning" mean — is something broken? No. It just means you haven't granted the optional Graph permission. The login check is unaffected.