Collect Microsoft Entra ID Organizational Context data (formerly Azure Active Directory) logs

Parser Version: 12.0

This document explains how to collect Microsoft Entra ID (formerly Azure Active Directory) organizational context data by setting up a Google Security Operations feed using the Third Party API.

Microsoft Entra ID Organizational Context provides directory information such as users, groups, and devices from your Microsoft Entra ID tenant. This is not event or log data - it is a periodic snapshot of directory state that enriches other log types in Google SecOps with identity context.

Before you begin

Make sure you have the following prerequisites:

• A Google SecOps instance
• Privileged access to the Microsoft Azure portal
• One of the following roles for granting administrator consent:
  • Global Administrator - can grant consent for any permission, for any API
  • Privileged Role Administrator - can grant consent for any permission, for any API

Configure IP allowlisting

You should add the Google SecOps IP ranges in your Microsoft Azure network settings or Conditional Access policies before creating your feed. This matters where the data source enforces IP-based restrictions. If the feed returns a 403 error, verify that allowlisting is enabled there. To restrict access by a narrower range, open a support ticket.

For more information, see IP Allowlisting.

Get Google SecOps IP ranges

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. Note the IP ranges displayed in the feed creation interface.
4. Alternatively, retrieve IP ranges programmatically using the Feed Management API.

Configure conditional access for workload identities (if required)

If your organization uses conditional access policies that restrict access by location do the following:

1. In the Microsoft Entra admin center, go to Protection > Conditional Access > Named locations.
2. Click + New location.
3. Provide the following configuration details:
   • Name: Enter Google SecOps IP Ranges.
   • Mark as trusted location: Optional, based on your security policy.
   • IP ranges: Add each Google SecOps IP range in CIDR notation.
4. Click Create.
5. Go to Conditional Access > Policies.
6. For any policies that apply to workload identities, configure an exclusion for the Google SecOps IP Ranges named location or the specific service principal.

Configure Microsoft Entra app registration

Create app registration

1. Sign in to the Microsoft Entra admin center or Azure portal.
2. Go to Identity > Applications > App registrations.
3. Click New registration.
4. Provide the following configuration details:
   • Name: Enter a descriptive name (for example, Google SecOps Entra ID Context Integration).
   • Supported account types: Select Accounts in this organizational directory only (Single tenant).
   • Redirect URI: Leave blank (not required for service principal authentication).
5. Click Register.
6. After registration, copy and save the following values:
   • Application (client) ID
   • Directory (tenant) ID

Configure API permissions

The feed reads the user directory through the Microsoft Graph List users endpoint, with each user's manager expanded. Grant the application permissions that match the feed options you enable.

1. In the app registration, go to API permissions.
2. Click Add a permission.
3. Select Microsoft Graph > Application permissions.
4. Search for and select the following permissions:
   • User.Read.All - Required. Reads the user profiles and the manager relationship that the feed ingests.
   • Group.Read.All - Only if you set Retrieve groups to True in the feed. Reads the groups returned for each user's membership.
   • Device.Read.All - Only if you set Retrieve devices to True in the feed. Reads the devices associated with each user.
5. Click Add permissions.
6. Click Grant admin consent for Your Organization.

7. Verify that the Status column shows Granted for Your Organization for all permissions.

   Permission	Type	When required
   User.Read.All	Application	Always
   Group.Read.All	Application	Retrieve groups is True
   Device.Read.All	Application	Retrieve devices is True

Create a client secret

1. In the app registration, go to Certificates & secrets.
2. Click New client secret.

3. Provide the following configuration details:

   • Description: Enter a descriptive name (for example, Google SecOps Feed).
   • Expires: Select an expiration period.

4. Click Add.

5. Copy the client secret Value immediately.

Configure a feed in Google SecOps to ingest Microsoft Entra ID organizational context data

To configure the feed, do the following:

1. Go to SIEM Settings > Feeds.
2. Click Add New Feed.
3. On the next page, click Configure a single feed.
4. In the Feed name field, enter a name for the feed (for example, Azure AD Organizational Context).
5. Select Third party API as the Source type.
6. Select Azure AD Organizational Context as the Log type.
7. Click Next.

8. Specify values for the following input parameters as follows:

   • OAuth Client ID: Enter the Application (client) ID from the app registration.
   • OAuth Client Secret: Enter the client secret value you copied earlier.
   • Tenant ID: Enter the Directory (tenant) ID from the app registration in UUID format (for example, 0fc279f9-fe30-41be-97d3-abe1d7681418).
   • Retrieve devices: Select whether to retrieve device information within user context. Set to True to include device data.
   • Retrieve groups: Select whether to retrieve group membership information within user context. Set to True to include group data.

   • API Full Path: Microsoft Graph REST API endpoint URL:

     graph.microsoft.com/beta
     

   • API Authentication Endpoint: Microsoft Entra ID Authentication Endpoint:

     login.microsoftonline.com
     

   Advanced Options:

   • Asset namespace: The asset namespace.
   • Ingestion labels: The label to be applied to the events from this feed.

9. Click Next.

10. Review your new feed configuration in the Finalize screen, and then click Submit.

Regional endpoints

For Microsoft Entra ID deployments in sovereign clouds, use the appropriate regional endpoints:

UDM mapping table

Change Log

View the Change Log for this parser

Need more help? Get answers from Community members and Google SecOps professionals.