Skip to content
English
Customer Portal
  • There are no suggestions because the search field is empty.

Security Controls for Mavim Azure, Microsoft Entra ID and Microsoft Graph Integration Overview

This article describes the security controls implemented by Mavim for integrations with Microsoft Entra ID and Microsoft Graph. It covers credential management, authentication security, application availability, logging and monitoring, identity validation, and secure transport mechanisms.

Secure Management of Secrets, Tokens, and Signing Keys

Customer-Owned Credentials

Mavim does not store OAuth client secrets, signing keys, or access tokens on behalf of customers. Customers remain responsible for managing credentials and cryptographic keys associated with their own Azure application registrations.

Single Page Application Authentication

The Mavim Single Page Application (SPA) uses the OAuth 2.0/2.1 Authorization Code Flow with Proof Key for Code Exchange (PKCE). Because PKCE is used, the browser-based application does not require a client secret.

Protection of Mavim Credentials

Where Mavim operates confidential client applications, client secrets are:

  • Stored exclusively in Azure Key Vault
  • Encrypted at rest
  • Protected through Azure Role-Based Access Control (RBAC)
  • Accessed through Managed Identities
  • Excluded from source code repositories
  • Excluded from container images
  • Excluded from CI/CD pipeline variables
  • Excluded from application logs
  • Never exposed to browser clients

Microsoft Token Signing Keys

Mavim does not possess or manage the signing keys used by Microsoft Entra ID. Microsoft is responsible for issuing and rotating signing keys. Mavim validates tokens using Microsoft's published public keys.

Browser Token Storage

Microsoft Authentication Library (MSAL.js) temporarily caches authentication tokens in browser session storage as part of the standard Microsoft authentication model for Single Page Applications.

Characteristics of these tokens include:

  • Short-lived validity periods (typically 60-90 minutes)
  • Session-based storage
  • Automatic expiration and renewal mechanisms

Security Mitigations

To reduce the risk associated with browser-based token storage, Mavim implements:

  • Regular XSS and application security testing
  • Content Security Policy (CSP)
  • Least-privilege permission requests for Microsoft Graph
  • Secure token handling through Microsoft's recommended authentication frameworks

Credential Rotation and Authentication Methods

Credential Rotation Policy

Mavim enforces a credential lifecycle policy for Azure application registrations.

Controls include:

  • Maximum client secret validity of 12 months
  • Mandatory rotation before expiration
  • Documented credential rotation procedures
  • Overlapping replacement credentials to prevent downtime
  • Expiration monitoring and alerting

Preferred Authentication Methods

For Microsoft Graph access, Mavim follows the following authentication preference order:

  1. Managed Identity
  2. Certificate-based authentication
  3. Client secrets only when platform limitations require them

Exceptions

Certain Microsoft ecosystem integrations, such as Power Platform custom connectors, require the use of client secrets. These integrations remain subject to the same credential governance controls, including rotation, alerting, and expiration management.

Protection Against Denial-of-Service and Abuse Rate Limiting

Web Applications

Mavim protects browser-accessible endpoints through Azure Front Door Web Application Firewall (WAF) operating in Prevention Mode. Microsoft-managed rule sets apply client-based rate limiting to mitigate abusive or automated traffic.

APIs

Azure API Management (APIM) provides:

  • Request throttling
  • Rate limiting
  • Usage quotas
  • Subscription key validation

Requests containing invalid subscription keys are rejected before backend processing occurs.

Web Application Firewall Inspection

An additional layer of protection is provided through Application Gateway WAF, which performs managed rule-set inspection before traffic reaches Azure Kubernetes Service (AKS).

Distributed Denial-of-Service Protection

Public-facing endpoints are protected through:

  • Azure DDoS Protection
  • Native Azure platform DDoS safeguards

Monitoring and Alerting

Azure Monitor continuously tracks:

  • WAF events and blocks
  • HTTP 429 responses
  • HTTP 5xx errors
  • Endpoint availability and health

Authentication Traffic Handling

User sign-in operations are handled by Microsoft Entra ID. Authentication traffic therefore benefits from Microsoft's own global-scale throttling, resilience, and availability controls.

Logging, Audit Trails, and Monitoring

Microsoft Entra ID Logging

The following security logs are collected and retained:

  • Sign-in logs
  • Audit logs
  • Consent grant activity
  • Permission changes
  • Credential modifications
  • Microsoft Graph activity logs

Logs are transferred to Azure Log Analytics through diagnostic settings and retained for six months.

Access Control

Access to logging and monitoring platforms is restricted through Azure RBAC.

Application Security Logging

Mavim records security-relevant events including:

  • Authentication successes
  • Authentication failures
  • Token validation failures and associated reasons
  • Microsoft Graph API requests
  • Response status codes
  • Request IDs
  • Correlation IDs
  • Trace identifiers

Logged Metadata

The following fields are retained for investigation and troubleshooting purposes:

  • Timestamp
  • Tenant ID
  • Application ID
  • Object ID
  • Correlation ID

Data Minimization

Application logs intentionally exclude:

  • Access tokens
  • Refresh tokens
  • Client secrets
  • Request payloads
  • Response payloads
  • User Principal Names (UPNs)
  • Email addresses

Security Alerts

Alerts are configured for:

  • New consent grants
  • Application credential creation or modification
  • Excessive failed sign-in attempts

Validation of Identity Claims and User Information Token Validation

ID Tokens

ID tokens are validated through Microsoft-supported authentication libraries and include verification of:

  • Issuer
  • Audience
  • Expiration
  • Nonce

Access Tokens

Backend services validate:

  • Digital signature
  • Issuer
  • Audience
  • Expiration
  • Required scopes

Tenant Validation

Multi-tenant access is controlled through an allow-list of approved tenant identifiers.

User Identity Model

Mavim identifies users based on the immutable combination of:

  • Tenant ID (tid)
  • Object ID (oid)

Mutable attributes such as email addresses and User Principal Names are not used as authoritative identity keys.

Microsoft Graph Data Handling

The application requests only the delegated User.Read Microsoft Graph permission.

Data retrieved from Microsoft Graph, such as display names and profile information:

  • Is used for display purposes only
  • Is never used for authorization decisions
  • Is never used for account matching
  • Is treated as untrusted input

Output Encoding

User-supplied and Microsoft Graph-sourced values are protected through:

  • Framework-provided output encoding
  • Protection against script injection
  • Prohibition of raw HTML rendering

Secure Transport and HTTPS Enforcement TLS Configuration

Mavim enforces modern transport security standards across all public-facing services.

The following components require a minimum TLS version of 1.2:

  • Azure Front Door
  • Azure API Management
  • Azure Application Gateway

Where supported, TLS 1.3 is enabled.

Approved cipher suites are restricted according to security best practices.

HTTP Strict Transport Security (HSTS)

Mavim enforces HSTS using:

Strict-Transport-Security: max-age=31536000; includeSubDomains (1 year)

The policy is applied to:

  • SPA endpoints
  • API endpoints
  • Error responses
  • Backend application responses

HTTPS Enforcement

All HTTP traffic is redirected to HTTPS at the edge.

Additional controls include:

  • Port 80 used only for redirects
  • APIs accepting HTTPS traffic exclusively
  • No support for insecure HTTP access

Redirect URI Security

OAuth redirect URIs and authentication callback endpoints are configured to allow HTTPS connections only.

Certificate Management

TLS certificates are:

  • Managed automatically
  • Renewed automatically
  • Continuously monitored for validity

Summary

Mavim applies a defense-in-depth security model for Azure, Microsoft Entra ID, and Microsoft Graph integrations. Security controls include:

  • Secure secret storage through Azure Key Vault
  • Managed Identity and certificate-based authentication
  • Formal credential rotation processes
  • WAF, APIM, and DDoS protection
  • Comprehensive logging and monitoring
  • Strict token and claim validation
  • Secure handling of Microsoft Graph data
  • TLS, HSTS, and HTTPS enforcement

These controls help ensure the confidentiality, integrity, and availability of authentication services and Microsoft Graph integrations while adhering to Microsoft security best practices.

© 2026 Mavim. All rights reserved.