What it collects
Through Microsoft Graph the connector collects Entra ID interactive and non-interactive sign-ins, directory audit events (user, group, role and application changes), and Microsoft 365 activity where the application has been granted access. Events arrive with event.module: entra or m365, the acting user in user.name, and risk and conditional access outcomes in their own fields.
Prerequisites
- An application registration in your tenant with application permissions to read audit logs and sign-ins, and for Microsoft 365 activity the corresponding audit permission. Admin consent is required.
- A client secret or certificate for the application.
- Outbound HTTPS from the deployment to Microsoft Graph.
Configure
Settings › Integrations › Add › Microsoft Entra ID. Enter the tenant identifier, application identifier and secret, choose the organization, and save. Sign-in logs typically lag a few minutes behind real time on Microsoft's side; the connector reports the lag it observes.
Response
With the corresponding permissions, playbooks can disable a user in Entra ID and quarantine a message in Microsoft 365 (move to Junk or soft-delete). Grant these only if you intend to use them.