...
Log Type | Ingestion label | Preferred Logging Protocol - Format | Log Collection Method | Data Source | |||
|---|---|---|---|---|---|---|---|
Azure AD | AZURE_AD | JSON | C2C | https://cloud.google.com/chronicle/docs/reference/feed-management-api#azure-ad | |||
Azure AD Directory Audit | AZURE_ADAZURE_AD_AUDIT | https://cloud.google.com/chronicle/docs/reference/feed-management-api#azure-ad-audit | |||||
Azure AD Organizational Context | AZURE_AD_AUDIT | JSON | C2C | https://cloud.google.com/chronicle/docs/reference/feed-management-api#azure-ad-context |
Device Configuration
For Microsoft Entra ID via 3RD Party API (Preferred):
...
To access the Microsoft Entra reporting API, you must grant your app Read directory data and Read all audit log data permissions for the Microsoft Graph API.
Select API Permissions → > Add a permission
...
Select Microsoft Graph > Application permissions.
Select the Application permissions option.
Add
AuditLog.Read.All,Directory.Read.AllandSecurityEvents.Read.Allthen select the Add permissions button.
...