Microsoft Azure AD

  • Updated on Nov 3, 2024
  • Published on Aug 13, 2024
Prev Next

image(54)

Self Service Ingestion

Connect this data source on your own, using the Hunters platform.

Overview

Microsoft Azure Entra ID (Azure AD) is a cloud-based identity and access management service that helps organizations manage access to applications, devices, and data. It provides a single identity platform for employees, customers, and partners to access various applications and services, both in the Microsoft cloud and on-premises.

Azure AD provides information about domain users and their properties, including person-related information.

Supported data types

Azure AD Users

Table name: azure_active_directory_users

Activities and events related to user accounts and their interactions within the Azure environment. These logs are vital for auditing, monitoring security incidents, analyzing usage patterns, and ensuring compliance with regulatory standards.

Azure AD Identity Protection

Table name: azure_ad_identity_protection

Risk detection reports provided by Microsoft. Azure AD Identity Protection generates logs that contain detailed information about detected risks, risk events, and risk remediation activities. These logs are crucial for organizations to understand the security posture of their identities and take proactive measures to protect against identity theft and compromise.

Send data to Hunters

To connect Microsoft Azure AD you’ll need to perform the following steps:

STEP 1: Register Your Application

🚧 Before you start

  1. Make sure you are performing this process with an Azure admin user. A Privileged Identity Management user is not enough.

  2. Make sure Identity Protection is enabled on your Azure environment. Learn how.

  1. On the Azure portal home screen, open the side menu and click Azure Entra ID.

    image(251)

  2. Now, from the side menu click Manage > App registration.
    The App registration menu opens.

  3. From the upper menu, click New registration.  
    The Register an application window opens.

    ms365-2

  4. Under the Name field, enter a descriptive name.

  5. Under the Redirect URI section, select Web platform and paste <http://localhost:5110> in the URL field.

  6. Click Register.

    The application window opens.

    ms365-3

  7. From the side menu, click API permissions.
    The Request API permissions panel opens.

  8. Click Add a permission.

    ms365-4

  9. Scroll down to locate the Microsoft Graph tile and click on it.

  10. Perform the following steps for both Delegated permissions AND Application permissions:

    1. For Azure AD Users - user.read and user.read.all permissions.

    2. For Azure AD Identity Protection - IdentityRiskEvent.Read.All permissions.

    3. Add these permissions.

    4. Click Grant admin consent for the directory.

      🚧NOTE

      Make sure you've granted the IdentityRiskEvent.Read.All permission, and not IdentityRiskyUser.

STEP 2: Retrieve the required information

  1. From the side menu, click Certificates & secrets.

  2. Click New client secret to open the client secret panel.

    ms365-8

  3. In the Description field, enter a descriptive title.

  4. From the Expires dropdown list, select 24 months.

  5. Click Add to add the secret.

    ms365-9


    The secret now appears under the Client secrets list.

  6. Copy the Value and save it for later use.

    ms365-10

❗️IMPORTANT

After a while, the client secret value will be hidden from view and you will not be able to retrieve it again.

  1. On Azure Entra ID, from the application window, click Overview from the side menu.

  2. Locate the Application (client) ID and the Directory (tenant) ID values, copy them, and save for later use.

    ms365-11

STEP 3: Enter information on Hunters

Finally, to provide Hunters with the required keys, follow this guide. Make sure to provide the following details:

  • Tenant ID

  • Client ID

  • Client Secret