Microsoft 365 Audit.General

1. Register an Entra ID Application

1. Go to **Microsoft Entra ID** > **App registrations** > **New registration** 2. Name: `Sentinel-M365Audit` (or your preferred name) 3. **Supported account types**: Accounts in this organizational directory only 4. Click **Register** 5. Note the **Application (client) ID** - you'll need this later 6. Go to **Certificates & secrets** > **New client secret** 7. Add a description, set expiration, click **Add** 8. **Copy the secret Value immediately** - it won't be shown again

2. Configure API Permissions

1. In your app registration, go to **API permissions** > **Add a permission** 2. Select **Office 365 Management APIs** 3. Choose **Application permissions** 4. Select **ActivityFeed.Read** 5. Click **Add permissions** 6. Click **Grant admin consent** for your tenant 7. Verify the permission shows as **Granted**

3. Subscribe to Audit.General Content

[concat('Run this PowerShell script to subscribe to the Audit.General content type (required before data flows): ```powershell # Replace with your values $tenantId = ''YOUR_TENANT_ID'' $clientId = ''YOUR_CLIENT_ID'' $clientSecret = ''YOUR_CLIENT_SECRET'' $publisherId = $tenantId # Publisher identifier is your tenant ID # Get OAuth token $body = @{ grant_type = ''client_credentials'' client_id = $clientId client_secret = $clientSecret resource = ''https://manage.office.com'' } $tokenResponse = Invoke-RestMethod -Method Post -Uri "', environment().authentication.loginEndpoint, '$tenantId/oauth2/token" -Body $body $token = $tokenResponse.access_token # Start subscription $headers = @{Authorization = "Bearer $token"} $subscribeUri = "https://manage.office.com/api/v1.0/$tenantId/activity/feed/subscriptions/start?contentType=Audit.General&PublisherIdentifier=$publisherId" Invoke-RestMethod -Method Post -Uri $subscribeUri -Headers $headers ```')]

4. Connect the Data Connector

Provide your Entra ID application credentials below. The connector will automatically use your subscription's tenant ID for authentication and API calls.