Microsoft Entra ID¶

Microsoft Entra ID, formerly Azure Active Directory, is an identity and access management solution from Microsoft that helps organizations secure and manage identities for hybrid and multicloud environments.

The Entra ID API Adapter polls Microsoft Graph directly and can collect three streams: Identity Protection risk detections, sign-in logs and directory audit logs. Because it only needs an Entra app registration — no Azure subscription or Event Hub — it is the lowest-friction way to standardize Entra telemetry collection across tenants. Data received via an Azure Event Hub or Webhook will be unique to your custom output parameters.

Entra ID data uses one of two platform values depending on the ingestion method — they are not interchangeable:

Azure Event Hub / Webhook (diagnostic settings log stream — SignInLogs, AuditLogs, etc.): client_options.platform: azure_ad
Entra ID API (risk detections, sign-in logs and directory audit logs polled from Microsoft Graph): client_options.platform: entraid

Note on naming: The platform identifier azure_ad reflects the legacy product name (Azure Active Directory). Microsoft renamed this product to Microsoft Entra ID in 2023. Despite naming the same product, azure_ad and entraid select different parsers: azure_ad parses the Azure diagnostic-stream records envelope (event type from category, timestamp from time), while entraid parses the Graph objects directly (event type from activity/category, or SignIn for sign-in records; timestamp from detectedDateTime/activityDateTime/createdDateTime depending on the stream). Crossing them silently breaks event-type and timestamp extraction.

Choosing by data need: Directory audit events — app consent (Consent to application), OAuth2 permission grants (Add OAuth2PermissionGrant), app role assignments, user/group/role changes — are available from the API adapter's audit_logs stream, from the diagnostic-stream AuditLogs category (Event Hub, platform azure_ad), or from the Microsoft 365 unified audit log (office365 adapter, Audit.AzureActiveDirectory content type, where operation names carry a trailing period). Also prefer azure_ad over azure_monitor for Entra streams: both parse the same envelope, but the platform value tags the sensor and drives is platform / LCQL targeting and shared detection rules.

Data Collected¶

API vs Event Hub vs Webhook Comparison¶

Method	Data Source	What You Get	Platform
Entra ID API	Microsoft Graph API	Risk detections, sign-in logs, directory audit logs (selectable streams)	`entraid`
Azure Event Hub	Azure Diagnostic Settings	Whatever logs you configure (sign-in, audit, etc.)	`azure_ad`
Webhook	Your configuration	Whatever you send to the webhook URL	`azure_ad` (if relaying the diagnostic-stream format)

Entra ID API¶

The API adapter polls Microsoft Graph every 30 seconds. The streams option selects which collections it polls, as comma separated values:

Stream	Graph endpoint	What You Get	LimaCharlie event type
`risk_detections` (default)	`/identityProtection/riskDetections`	Identity Protection risk detection alerts (risky sign-ins, leaked credentials, anonymous IPs, malware-linked IPs, …)	the detection's `activity` (e.g. `signin`)
`sign_ins`	`/auditLogs/signIns`	Interactive sign-in events (user, app, IP, location, device, conditional access result)	`SignIn`
`audit_logs`	`/auditLogs/directoryAudits`	Directory changes: user/group/role management, app registrations, app consent and OAuth2 permission grants	the audit's `category` (e.g. `UserManagement`, `ApplicationManagement`)

For example, streams: risk_detections,sign_ins,audit_logs collects everything; leaving the option empty collects risk detections only, matching the historical behavior of existing deployments.

For the full list of risk detection types, see Microsoft's documentation.

Requirements per stream:

risk_detections requires the IdentityRiskEvent.Read.All application permission. Note the tenant only produces risk detections with Entra ID Identity Protection (P2 for the full detection set).
sign_ins requires the AuditLog.Read.All and Directory.Read.All application permissions, and the tenant must hold an Entra ID P1 (or P2) license — a Microsoft Graph requirement, the same one that applies to streaming SignInLogs to an Event Hub.
audit_logs requires the AuditLog.Read.All application permission.

Azure Event Hub¶

When using Event Hub, you receive whatever data you configure Azure to stream. You must configure Azure Diagnostic Settings in Entra ID to send logs to your Event Hub. Common log types include:

Sign-in logs - Interactive and non-interactive authentication events
Audit logs - Directory changes (user/group management, app registrations, app consent and OAuth2 permission grants)
Provisioning logs - User provisioning to SaaS apps
Risky users/sign-ins - Identity Protection detections (alternative to API)

In the azure_ad stream the LimaCharlie event type is the log category (e.g. AuditLogs, SignInLogs), so detection rules targeting a specific operation match on the event/operationName field.

See Microsoft's documentation on streaming Entra ID logs.

Adapter Deployment¶

Microsoft Entra ID logs are ingested into LimaCharlie via:

Azure Event Hub
Entra ID API
Webhooks

Azure Event Hub¶

Within the LimaCharlie web app, there is a helper that can be used to easily configure receiving Entra ID events via an Azure Event Hub.

If utilizing the helper, only two fields are required:

Name for the adapter
Connection string to the Azure Event Hub

See the Azure Event Hub Adapter documentation for more information.

Microsoft has documentation for creating an Event Hub.

Entra ID API¶

To collect data via the Entra ID API, you'll need to configure an App Registration in Azure and ensure it has the correct permissions.

In Azure, navigate to the Entra ID Overview page. Select App Registrations and click + New Registration.
Name the application, and select the Supported account types.
After registering an App, you'll be provided metadata for that application. Take note of the Application (client) ID and Directory (tenant) ID fields, as you will need them for configuration.
Select Add a certificate or secret, and create a new client secret. Provide a description and select an applicable Expiration time. Note: You will need to refresh the Secret in LimaCharlie once it expires!
After creating the secret, copy the Secret Value. You will need this to configure the LimaCharlie Adapter.
Navigate to the Manage > API permissions menu for your newly-created application. Grant the Application permissions required by the streams you plan to collect (see Requirements per stream):
IdentityRiskEvent.Read.All (risk_detections)
AuditLog.Read.All (sign_ins, audit_logs)
Directory.Read.All (sign_ins)
User.Read (default)
Click Grant admin consent for the tenant — application permissions have no effect until an admin consents.

Create a new Adapter within LimaCharlie, and select Microsoft Entra ID. Select Microsoft Entra ID API as the ingestion method.

Name the Adapter and provide the following details:
Tenant ID
Client ID
Client Secret
Streams (optional): comma separated values among risk_detections, sign_ins and audit_logs; empty means risk_detections only
Note: You can use the Secrets Manager for these values if you wish!

Click Complete Cloud Installation, and the Adapter should be created successfully. Monitor the Platform Logs for any errors.

Note: Collection starts from the moment the Adapter is created (there is no historical backfill), so a stream only produces events as new ones occur. For risk_detections in particular, silence after creation usually just means no risky events have happened yet!

Webhooks¶

Within the LimaCharlie web app, there is a helper that can be used to easily configure receiving Entra ID events.

If utilizing the helper, only two fields are required:

Name for the adapter
Secret component of the URL for the webhook

More information about creating a webhook and obtaining the completed URL, utilizing the secret component, can be found here.