Connector reauthorization — May 2026 security upgrade

Audience: Secruna customer admins. TL;DR: Sometime in the next few weeks you'll see a yellow banner asking you to reauthorize your Azure / M365 / GCP connector. Click the banner, sign back in once (~30 seconds), and you're done.

What changed

We've split the OAuth application that powers Secruna in two:

1. Sign-in — the "Sign in with Microsoft / Google" button on auth.secruna.com.
2. Discovery — the data-plane connectors that read your Azure subscriptions, M365 tenant, or GCP projects.

Before May 2026 these shared a single OAuth app per vendor. Splitting them is a security-hygiene win:

• The sign-in screen no longer asks for resource-read scopes you'd expect a connector to ask for, not the login button.
• A compromised OAuth secret on one side can't be replayed against the other.
• It unlocks us to delete the long-lived client_secret value for sign-in entirely once federated-identity rolls out fully.

What you'll see

Open your Secruna dashboard. On /connections/[id] for any existing Azure / M365 / GCP row you'll see an Auth version: legacy (reauth required) badge in the header, plus the standard Plan-72 banner:

Your authorization for this connector was granted to our previous OAuth client. To keep discovery running, please reauthorize. [Reauthorize →]

Click Reauthorize. You'll bounce to your IdP (Microsoft / Google) for a fresh consent. The new consent screen will show ONLY the resource scopes — no sign-in scopes. Approve. You're returned to Secruna with the connector back in active status; the badge flips to Auth version: v2 and the banner clears.

Why now

Two reasons:

1. Plan 115 federated identity removes the need for long-lived client secrets entirely. To finish that work for sign-in too, the two apps need separate registrations.
2. Customer admins kept asking us to explain why the sign-in consent screen listed Azure Resource Graph scopes. "Because login and discovery share an app" is fine technically; it was confusing UX.

How long will it take?

• Reauthorization: ~30 seconds end-to-end. Click banner → consent → back.
• Frequency: once per connector, never again.

What if I don't reauthorize?

Your existing scheduled discovery runs will start returning auth_expired after the next refresh-token cycle. The runs don't crash — Secruna still renders the connection but stops fetching new resources from it. As soon as you reauthorize, scheduled discovery resumes on its normal cadence.

Will my historical data disappear?

No. The reauthorization just gives Secruna a new refresh token issued by the new discovery app; the underlying customer-tenant grant (Microsoft admin consent / Google project IAM) stays in place. Historical artifacts and verdicts are unaffected.

Questions?

Email support@secruna.com or hit the chat icon bottom-right.