{
    "id": "AzureActiveDirectory",
    "title": "Microsoft Entra ID",
    "publisher": "Microsoft",
    "logo": {
        "type": 3,
        "options": null
    },
    "descriptionMarkdown": "Gain insights into Microsoft Entra ID by connecting Audit and Sign-in logs to Microsoft Sentinel to gather insights around Microsoft Entra ID scenarios. You can learn about app usage, conditional access policies, legacy auth relate details using our Sign-in logs. You can get information on your Self Service Password Reset (SSPR) usage, Microsoft Entra ID Management activities like user, group, role, app management using our Audit logs table. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/?linkid=2219715&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SigninLogs",
            "baseQuery": "SigninLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "AuditLogs",
            "baseQuery": "AuditLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "AADNonInteractiveUserSignInLogs",
            "baseQuery": "AADNonInteractiveUserSignInLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "AADServicePrincipalSignInLogs",
            "baseQuery": "AADServicePrincipalSignInLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "AADManagedIdentitySignInLogs",
            "baseQuery": "AADManagedIdentitySignInLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "AADProvisioningLogs",
            "baseQuery": "AADProvisioningLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "ADFSSignInLogs",
            "baseQuery": "ADFSSignInLogs"
        },
        {
            "metricName": "Total data received",
            "legend": "AADUserRiskEvents",
            "baseQuery": "AADUserRiskEvents"
        },
        {
            "metricName": "Total data received",
            "legend": "AADRiskyUsers",
            "baseQuery": "AADRiskyUsers"
        },
        {
            "metricName": "Total data received",
            "legend": "NetworkAccessTraffic",
            "baseQuery": "NetworkAccessTraffic"
        },
        {
            "metricName": "Total data received",
            "legend": "AADRiskyServicePrincipals",
            "baseQuery": "AADRiskyServicePrincipals"
        },
        {
            "metricName": "Total data received",
            "legend": "AADServicePrincipalRiskEvents",
            "baseQuery": "AADServicePrincipalRiskEvents"
        }
    ],
    "lastDataReceivedInfoBalloon": "If no new data has been received in the last 14 days, the connector will display as being \"not connected.\" When the connector will recive data , the \"connected\" status will return.",
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "SigninLogs\n            | take 1000\n            | sort by TimeGenerated"
        },
        {
            "description": "Summarize by 1 hour bins",
            "query": "AuditLogs\n            | summarize count() by bin(TimeGenerated, 1h)\n            | sort by TimeGenerated"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "IsConnectedQuery",
            "value": [
                "SigninLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AuditLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADNonInteractiveUserSignInLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADServicePrincipalSignInLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADManagedIdentitySignInLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADProvisioningLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "ADFSSignInLogs\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADUserRiskEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADRiskyUsers\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "NetworkAccessTraffic\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADRiskyServicePrincipals\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)",
                "AADServicePrincipalRiskEvents\n            | summarize LastLogReceived = max(TimeGenerated)\n            | project IsConnected = LastLogReceived > ago(7d)"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "SigninLogs",
            "lastDataReceivedQuery": "SigninLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AuditLogs",
            "lastDataReceivedQuery": "AuditLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADNonInteractiveUserSignInLogs",
            "lastDataReceivedQuery": "AADNonInteractiveUserSignInLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADServicePrincipalSignInLogs",
            "lastDataReceivedQuery": "AADServicePrincipalSignInLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADManagedIdentitySignInLogs",
            "lastDataReceivedQuery": "AADManagedIdentitySignInLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADProvisioningLogs",
            "lastDataReceivedQuery": "AADProvisioningLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "ADFSSignInLogs",
            "lastDataReceivedQuery": "ADFSSignInLogs\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADUserRiskEvents",
            "lastDataReceivedQuery": "AADUserRiskEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADRiskyUsers",
            "lastDataReceivedQuery": "AADRiskyUsers\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "NetworkAccessTraffic",
            "lastDataReceivedQuery": "NetworkAccessTraffic\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADRiskyServicePrincipals",
            "lastDataReceivedQuery": "AADRiskyServicePrincipals\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        },
        {
            "name": "AADServicePrincipalRiskEvents",
            "lastDataReceivedQuery": "AADServicePrincipalRiskEvents\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 1,
        "isPreview": false
    },
    "permissions": {
        "tenant": [
            "GlobalAdmin",
            "SecurityAdmin"
        ],
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            },
            {
                "provider": "microsoft.aadiam/diagnosticSettings",
                "providerDisplayName": "Diagnostic Settings",
                "permissionsDisplayText": "read and write permissions to AAD diagnostic settings.",
                "requiredPermissions": {
                    "read": true,
                    "write": true
                },
                "scope": "/providers/microsoft.aadiam"
            }
        ]
    },
    "instructionSteps": [
        {
            "title": "Connect Microsoft Entra ID logs to Microsoft Sentinel",
            "description": "Select Microsoft Entra ID log types:",
            "instructions": [
                {
                    "parameters": {
                        "connectorKind": "AzureActiveDirectory",
                        "dataTypes": [
                            {
                                "title": "Sign-In Logs",
                                "name": "SignInLogs",
                                "infoBoxHtmlTemplate": "In order to export Sign-in data, your organization needs Microsoft Entra ID P1 or P2 license. If you don't have a P1 or P2, <a target=\"_blank\" href=\"https://ms.portal.azure.com/#blade/Microsoft_AAD_IAM/TryBuyProductBlade\">start a free trial.</a>"
                            },
                            {
                                "title": "Audit Logs",
                                "name": "AuditLogs"
                            },
                            {
                                "title": "Non-Interactive User Sign-In Log",
                                "name": "NonInteractiveUserSignInLogs"
                            },
                            {
                                "title": "Service Principal Sign-In Logs",
                                "name": "ServicePrincipalSignInLogs"
                            },
                            {
                                "title": "Managed Identity Sign-In Logs",
                                "name": "ManagedIdentitySignInLogs"
                            },
                            {
                                "title": "Provisioning Logs",
                                "name": "ProvisioningLogs"
                            },
                            {
                                "title": "ADFS Sign-In Logs",
                                "name": "ADFSSignInLogs"
                            },
                            {
                                "title": "User Risk Events",
                                "name": "UserRiskEvents"
                            },
                            {
                                "title": "Risky Users",
                                "name": "RiskyUsers"
                            },
                            {
                                "title": "Network Access Traffic Logs",
                                "name": "NetworkAccessTrafficLogs"
                            },
                            {
                                "title": "Risky Service Principals",
                                "name": "RiskyServicePrincipals"
                            },
                            {
                                "title": "Service Principal Risk Events",
                                "name": "ServicePrincipalRiskEvents"
                            }
                        ]
                    },
                    "type": "AADDataTypes"
                }
            ]
        }
    ]
}