Cloud Identity Engine - AAD

[zimmie67]

I am investigating Cloud Identity Engine for integration with Azure AD (Entra ID). I am trying to understand where CIE stores the data that it syncs from AAD (what the actual authentication flow looks like) so we can validate whether user data is going to a 3rd party provider such as Palo Alto.
Also does CIE sync and cache user passwords when they authenticate through it?  or is it just passing the request to Azure AD and, if so, how is that pw protected/encrypted/encapsulated?

thanks

[reaper]

for group mapping the groups and their members' attributes are stored on the CIE tenant, so for compliance you'll need to make sure the tenant is stood up in the appropriate location (this stored data will not leave that location except for forwarding to your firewalls)

CIE with authentication simply acts as a broker and AFAIK does not store anything