Microsoft Entra ID (Azure AD)

About The Device

Microsoft Entra ID:
Microsoft Entra ID is a cloud-based identity and access management service that enables your employees access external resources. Example resources include Microsoft 365, the Azure portal, and thousands of other SaaS applications. Microsoft Entra ID also helps them access internal resources like apps on your corporate intranet, and any cloud apps developed for your own organization.

Microsoft Entra ID B2C: (C2C - Storage)
Entra ID B2C provides business-to-customer identity as a service. Your customers can use their preferred social, enterprise, or local account identities to get single sign-on access to your applications and APIs. Entra ID B2C is a customer identity access management (CIAM) solution capable of supporting millions of users and billions of authentications per day. It takes care of the scaling and safety of the authentication platform, monitoring, and automatically handling threats like denial-of-service, password spray, or brute force attacks.

Device Information

Collection Method

Device Configuration

For Microsoft Entra ID via 3RD Party API (Preferred):

Prerequisites:

1. Get an Microsoft Entra ID P1 or P2 license.

2. To get access to the reporting data through the API, you need to have one of the following roles:

   1. Security Reader

   2. Security Administrator

   3. Global Administrator

Register a Microsoft Entra application:

1. Sign in to the Microsoft Entra admin center as at least a Security Reader.

2. Browse to Identity > Applications > App registrations.

3. Select New registration.

4. On the Registration an Application page:

   1. Give the application a Name.

   2. For Supported accounts type, select Accounts in this organizational directory only.

   3. In the Redirect URI section, select Web from the list and type https://localhost.

   4. Select Register.

5. Once Application is created, you will see Application (client) ID & Directory (tenant) ID on Overview tab of the application. Copy these IDs for integrations with Chronicle.

Grant permissions:

To access the Microsoft Entra reporting API, you must grant your app Read directory data and Read all audit log data permissions for the Microsoft Graph API.

6. Select API Permissions → Add a permission

7. Select Microsoft Graph > Application permissions.

8. Select the Application permissions option.

9. Add AuditLog.Read.All ,Directory.Read.All and SecurityEvents.Read.All then select the Add permissions button.

10. On the Request API Permissions page, select Grant admin consent for Default Directory.

Add a client secret:

11. In the Certificates & Secrets tab, and click New client secret.

12. Select description and expiry period for the created secret and create it.

Important: Make sure you save the value for the created secret. It is only displayed once.

Configuration of the Entra ID application is completed. Use the saved Application (client) ID, Client Secret, and Directory (tenant) ID to feed logs in Chronicle.

Via Azure Storage (Alternative):

Pre-requisite:

An Azure subscription that you can sign in to.

An Entra ID(Azure Active Directory) (tenant) in Azure.

A user who's a Global Administrator or Entra ID(Azure Active Directory) Administrator.

Azure Storage Account to store the logs.

Reference URLs

How to create storage account?
Create a storage account - Azure Storage

Configuration Steps for Azure Active Directory:

1. Log In to Azure Portal i.e https://portal.azure.com/

2. Click Entra ID (Azure Active Directory) from Azure services

3. Click Audit Logs in the left pane

4. Click Export Data Settings

5. In the next window, click + Add Diagnostic setting. The Diagnostics settings page provides the settings for the diagnostic logs.

6. Select AuditLogs, SignInLogs and RiskyUsers from log categories.

7. You can store logs in Storage Account.

   1. Archive to a storage account

      1. To store logs in Storage Account, select Archive to a storage account as shown in below screenshot and Choose an existing Subscription and Storage account.
         Note: AMxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies

8. Click on Save.

Entra ID (Azure Active Directory) B2C Via Azure Storage (Alternative):

Pre-requisite:

An Azure subscription that you can sign in to.
An Entra ID(Azure Active Directory) (tenant) in Azure.
For Entra ID(Azure Active Directory) B2C - Entra ID(Azure AD) B2C administrative account.
Azure Storage Account to store the logs.

1. Sign in to the Azure portal with your Entra ID B2C administrative account.

2. Make sure you're using the directory that contains your Entra ID B2C tenant:

   1. In the Azure portal toolbar, select the Directories + subscriptions ( )icon.

   2. On the Portal settings | Directories + subscriptions page, find your Entra ID B2C directory in the Directory name list, and then select Switch.

3.  Select Microsoft Entra ID.

4. Under Monitoring, select Diagnostic settings. select Add diagnostic setting.

5.  Select AuditLogs, SignInLogs and RiskyUsers from log categories.

6. You can store logs in Storage Account.

   1. Archive to a storage account

      1. To store logs in Storage Account, select Archive to a storage account as shown in below screenshot and Choose an existing Subscription and Storage account.
         Note: AMxDR recommends a minimum of 1 day of log retention, the number can be defined based on the organization's policies.

7. Click Save.

8. Use below link to see, how you can get credentials of Azure Storage.
   Get Credentials of Azure Storage

Integration Parameters

Parameters required from customer for Integration.

For Microsoft Entra ID Via 3RD Party API (Preferred):

For Microsoft Entra ID & Entra ID B2C Via Azure Storage (Alternative):