Microsoft Entra ID

Microsoft Entra ID, formerly Azure Active Directory, is an identity and access management solution from Microsoft that helps organizations secure and manage identities for hybrid and multicloud environments.

Entra ID events are recognized as the azure_ad platform.

Adapter Deployment

Microsoft Entra ID logs are ingested into LimaCharlie via an Azure Event Hub or Webhooks.

Azure Event Hub

Within the LimaCharlie web app, there is a helper that can be used to easily configure receiving Entra ID events via an Azure Event Hub.

If utilizing the helper, only two fields are needed:

• Name for the adapter
• Connection string to the Azure Event Hub

You can find more information about Azure Event Hub Adapters here.

Documentation for creating an event hub can be found here here.

Webhooks

Within the LimaCharlie web app, there is a helper that can be used to easily configure receiving Entra ID events.

If utilizing the helper, only two fields are needed:

• Name for the adapter
• Secret component of the URL for the webhook

More information about creating a webhook and obtaining the completed URL, utilizing the secret component, can be found here.