{
    "id": "AzureActiveDirectoryIdentityProtection",
    "title": "Microsoft Entra ID Protection",
    "publisher": "Microsoft",
    "logo": {
        "type": 3,
        "options": null
    },
    "descriptionMarkdown": "Microsoft Entra ID Protection provides a consolidated view at risk users, risk events and vulnerabilities, with the ability to remediate risk immediately, and set policies to auto-remediate future events. The service is built on Microsoft’s experience protecting consumer identities and gains tremendous accuracy from the signal from over 13 billion logins a day. Integrate Microsoft Microsoft Entra ID Protection alerts with Microsoft Sentinel to view dashboards, create custom alerts, and improve investigation. For more information, see the [Microsoft Sentinel documentation ](https://go.microsoft.com/fwlink/p/?linkid=2220065&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).\n\n[Get Microsoft Entra ID Premium P1/P2 ](https://aka.ms/asi-ipcconnectorgetlink)",
    "graphQueries": [
        {
            "metricName": "Total data received",
            "legend": "SecurityAlerts (IPC)",
            "baseQuery": "SecurityAlert | where ProductName == \"Azure Active Directory Identity Protection\""
        }
    ],
    "sampleQueries": [
        {
            "description": "All logs",
            "query": "SecurityAlert | where ProductName == \"Azure Active Directory Identity Protection\" ​| summarize arg_max(TimeGenerated, *) by SystemAlertId\n            | sort by TimeGenerated"
        },
        {
            "description": "Summarize by severity",
            "query": "SecurityAlert | where ProductName == \"Azure Active Directory Identity Protection\" ​| summarize arg_max(TimeGenerated, *) by SystemAlertId\n            | summarize count() by AlertSeverity"
        }
    ],
    "connectivityCriterias": [
        {
            "type": "MtpAlerts",
            "value": [
                "AzureActiveDirectory"
            ]
        }
    ],
    "dataTypes": [
        {
            "name": "SecurityAlert (IPC)",
            "lastDataReceivedQuery": "SecurityAlert | where ProductName == \"Azure Active Directory Identity Protection\"\n            | summarize Time = max(TimeGenerated)\n            | where isnotempty(Time)"
        }
    ],
    "availability": {
        "status": 2,
        "isPreview": false,
        "featureFlag": {
            "feature": "AadIp",
            "featureStates": {
                "1": 2,
                "2": 2,
                "3": 2,
                "4": 2,
                "5": 2,
                "6": 1,
                "7": 1
            }
        }
    },
    "permissions": {
        "resourceProvider": [
            {
                "provider": "Microsoft.OperationalInsights/workspaces",
                "permissionsDisplayText": "read and write permissions.",
                "providerDisplayName": "Workspace",
                "scope": "Workspace",
                "requiredPermissions": {
                    "read": true,
                    "write": true,
                    "delete": true
                }
            }
        ],
        "tenant": [
            "GlobalAdmin",
            "SecurityAdmin"
        ],
        "licenses": [
            "AadP1P2"
        ]
    },
    "instructionSteps": [
        {
            "title": "Microsoft Entra ID Protection alerts to Microsoft Sentinel",
            "description": "Connect Microsoft Entra ID Protection to Microsoft Sentinel. \n            \n> The alerts are sent to this Microsoft Sentinel workspace.",
            "instructions": [
                {
                    "parameters": {
                        "connectorKind": "AzureActiveDirectory",
                        "title": "Microsoft Entra ID Protection",
                        "enable": true
                    },
                    "type": "SentinelResourceProvider"
                }
            ]
        }
    ],
    "caseGenerationSteps": [
        {
            "instructions": [
                {
                    "parameters": {
                        "filterProduct": "Microsoft Entra ID Protection"
                    },
                    "type": "FilterAlert"
                }
            ]
        }
    ]
}