---
title: "Microsoft Azure AD"
slug: "microsoft-azure-ad-users"
updated: 2025-12-21T15:26:09Z
published: 2025-12-21T15:26:09Z
canonical: "docs.hunters.ai/microsoft-azure-ad-users"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft Azure AD

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

> [!CAUTION]
> Clarifications about licenses and roles before setting up Azure AD:
> 
> - Clients must have an **Azure AD Premium P2 license** before they can use Identity Protection permissions.
> - **Identity Protection Permissions – Licensing Requirement**
>   - Required permission for Azure AD Identity Protection is listed as: `IdentityRiskEvent.Read.All`
>   - Required permissions for both **Delegated** and **Application** access:
> 
> Azure AD Users: `User.Read`, `User.Read.All`
> 
> Azure AD Identity Protection: `IdentityRiskEvent.Read.All`
>   - After adding these permissions, make sure to click `Grant admin consent for the directory`.
> 
> Important Note Ensure that you're granting `IdentityRiskEvent.Read.All` - **and NOT** `IdentityRiskyUser`.

## Overview

Microsoft Azure Entra ID (Azure AD) is a cloud-based identity and access management service that helps organizations manage access to applications, devices, and data. It provides a single identity platform for employees, customers, and partners to access various applications and services, both in the Microsoft cloud and on-premises.![image(54)](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(54).png)

Azure AD provides information about domain users and their properties, including person-related information.

## Supported data types

### Azure AD Users

**Table name:** `azure_active_directory_users`

Activities and events related to user accounts and their interactions within the Azure environment. These logs are vital for auditing, monitoring security incidents, analyzing usage patterns, and ensuring compliance with regulatory standards.

### Azure AD Identity Protection

**Table name:** `azure_ad_identity_protection`

[Risk detection](https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risk-detections) reports provided by Microsoft. Azure AD Identity Protection generates logs that contain detailed information about detected risks, risk events, and risk remediation activities. These logs are crucial for organizations to understand the security posture of their identities and take proactive measures to protect against identity theft and compromise.

## Send data to Hunters

To connect Microsoft Azure AD you’ll need to perform the following steps:

****STEP 1: Register Your Application****

> [!WARNING]
> 🚧 Before you start
> 
> 1. Make sure you are performing this process with an **Azure admin** user. A Privileged Identity Management user is not enough.
> 2. Make sure **Identity Protection** is enabled on your Azure environment. [Learn how](https://learn.microsoft.com/en-us/training/modules/azure-ad-identity-protection/).

1. On the Azure portal home screen, open the side menu and click **Microsoft Entra ID**.

![image(251)](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image(251).png)
2. Now, from the side menu click **Manage > App registration**. The App registration menu opens.
3. From the upper menu, click **New registration**. The Register an application window opens.

![ms365-2](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-2.png)
4. Under the **Name** field, enter a descriptive name.
5. Under the **Redirect URI** section, select **Web** platform and paste <[http://localhost:5110](http://localhost:5110)> in the **URL** field.
6. Click **Register**. The application window opens.

![ms365-3](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-3.png)
7. From the side menu, click **API permissions**. The Request API permissions panel opens.
8. Click **Add a permission**.

![ms365-4](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-4.png)
9. Scroll down to locate the **Microsoft Graph** tile and click on it.
10. Perform the following steps for both **Delegated permissions** AND **Application permissions**:
  1. For Azure AD Users - `user.read` and `user.read.all` permissions.
  2. For Azure AD Identity Protection - `IdentityRiskEvent.Read.All` permissions.
  3. Add these permissions.
  4. Click **Grant admin consent for the directory**.

> [!WARNING]
> 🚧NOTE
> 
> Make sure you've granted the IdentityRisk**Event**.Read.All permission, and not IdentityRisky**User**.

****STEP 2: Retrieve the required information****

1. From the side menu, click **Certificates & secrets**.
2. Click **New client secret** to open the client secret panel.

![ms365-8](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-8.png)
3. In the **Description** field, enter a descriptive title.
4. From the **Expires** dropdown list, select **24 months**.
5. Click **Add** to add the secret.

![ms365-9](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-9.png)

The secret now appears under the Client secrets list.
6. Copy the **Value** and save it for later use.

![ms365-10](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-10.png)

> [!CAUTION]
> ❗️IMPORTANT
> 
> After a while, the client secret value will be hidden from view and you will not be able to retrieve it again.

1. On Azure Entra ID, from the application window, click **Overview** from the side menu.
2. Locate the **Application (client) ID** and the **Directory (tenant) ID** values, copy them, and save for later use.

![ms365-11](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/ms365-11.png)

****STEP 3: Enter information on Hunters****

Finally, to provide Hunters with the required keys, follow [this guide](/v1/docs/connect-a-data-source-using-apiwebhook). Make sure to provide the following details:

- Tenant ID
- Client ID
- Client Secret