What it collects
Through Microsoft Graph the connector collects Entra ID sign-ins, which cover Microsoft 365 sign-ins, and directory audit events (user, group, role and application changes). Events arrive with observer.product: entra and event.dataset set to entra.signin or entra.audit, the acting user in user.name, and risk and conditional access outcomes in their own fields.
Prerequisites
- An application registration in your tenant with application permissions to read audit logs and sign-ins. Admin consent is required.
- A client secret for the application.
- Outbound HTTPS from the deployment to Microsoft Graph.
Configure
Settings › Integrations › Add integration › Microsoft 365 / Entra ID. Enter the tenant ID, client ID and client secret, choose the organization, and save. Microsoft publishes sign-in logs a few minutes behind real time.
Response
With the corresponding permissions, playbooks can disable a user in Entra ID, revoke their sessions, and quarantine or delete a message in Microsoft 365 (move to Junk or soft-delete). Grant these only if you intend to use them.