Description
This IPinfo data connector installs an Azure Function app to download standard_abuse datasets and insert it into custom log table in Microsoft Sentinel
- Declared status
- 1
- Declared author / publisher
- IPinfo
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
read and write permissions on the workspace are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Microsoft.Web/sites permissions
Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/).
IPinfo API Token
Retrieve your IPinfo API Token [here](https://ipinfo.io/).
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
1. Retrieve API Token
Retrieve your IPinfo API Token [here](https://ipinfo.io/).
2. In your Azure AD tenant, create an Azure Active Directory (AAD) application
In your Azure AD tenant, create an Azure Active Directory (AAD) application and acquire Tenant ID, Client ID, and Client Secret: Use this Link.
3. Assign the AAD application the Microsoft Sentinel Contributor Role.
Assign the AAD application you just created to the Contributor(Privileged administrator roles) and Monitoring Metrics Publisher(Job function roles) in the same “Resource Group” you use for “Log Analytic Workspace” on which “Microsoft Sentinel” is added: Use this Link.
4. Get Workspace Resource ID
Use the Log Analytic Workspace -> Properties blade having the 'Resource ID' property value. This is a fully qualified resourceId which is in the format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}'
5. Deploy the Azure Function
Use this for automated deployment of the IPinfo data connector using an ARM Tempate.
1. Click the **Deploy to Azure** button below.
[](https://aka.ms/sentinel-IPinfo-Abuse-azuredeploy)
2. Select the preferred **Subscription**, **Resource Group** and **Location**.
3. Enter the **RESOURCE_ID**, **IPINFO_TOKEN**, **TENANT_ID**, **CLIENT_ID**, **CLIENT_SECRET**.
Manual Deployment of Azure Functions
Use the following step-by-step instructions to deploy the IPinfo data connector manually with Azure Functions (Deployment via Visual Studio Code).
Step 1 - Deploy a Function App
1. Download the Azure Function App file. Extract the archive to your local development computer [Azure Function App](https://aka.ms/sentinel-Ipinfo-Abuse-functionapp).
2. Create Function App using Hosting Functions Premium or App service plan using advanced option using VSCode.
3. Follow the function app manual deployment instructions to deploy the Azure Functions app using VSCode.
4. After successful deployment of the function app, follow the next steps for configuring it.
Step 2 - Configure the Function App
1. Go to Azure Portal for the Function App configuration.
2. In the Function App, select the Function App Name and select **Settings** -> **Configuration** or **Environment variables**.
3. In the **Application settings** tab, select **+ New application setting**.
4. Add each of the following application settings individually, with their respective string values (case-sensitive):
RESOURCE_ID
IPINFO_TOKEN
TENANT_ID
CLIENT_ID
CLIENT_SECRET
RETENTION_IN_DAYS
TOTAL_RETENTION_IN_DAYS
SCHEDULE
LOCATION
5. Once all application settings have been entered, click **Save**.
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
IPinfoAbuseDataConnector
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC