Skip to content

Add Microsoft Entra ID Assets (Preview) connector and parser - #15482

Draft
cassidyking17 wants to merge 4 commits into
Azure:masterfrom
cassidyking17:cassidyking-microsoft-entra-connector-draft-pr
Draft

cassidyking17 wants to merge 4 commits into
Azure:masterfrom
cassidyking17:cassidyking-microsoft-entra-connector-draft-pr

Conversation

@cassidyking17

@cassidyking17 cassidyking17 commented Oct 28, 2026 •

Copy link
Copy Markdown

Required items, please complete

Change(s):

  • Add Microsoft Entra ID Assets (Preview) to the existing Microsoft Entra ID Assets solution: definition, 23 pollers and DCR routing to twelve onboarded Microsoft-managed Entra tables.
  • Use EntraApplications-style table/query names and Microsoft-EntraApplications-style standard output streams. Custom Graph input streams are schema declarations, not custom workspace tables; no custom table creation resources are included.
  • Use the internal connector identity MicrosoftEntraIDAssetsCCF and DCR identity MicrosoftEntraIDAssetsDCR, with no temporary test-version references.
  • Add one parser displayed as Parser for Microsoft Entra ID Assets, callable as EntraAssetsNormalize(T:(*)), for query-time camelCase-to-PascalCase normalization across all datasets.
  • Add a required Tables to collect multi-select to connection setup, with all twelve tables selected by default. Each selection gates every poller for that table, including snapshot and delta feeds and multiple relationship paths.
  • This is a setup-only selector, not a live ingestion toggle. A warning explains that reducing a selection does not stop existing collectors; their pollers must be explicitly disconnected/deleted. Stored data is retained.
  • Add a deprecation notice and replacement/migration link to the legacy connector tile while preserving its ID, connectivity, instructions, and Purview dependency warning.
  • Add customer setup, schema, limitations, and migration guidance. Retain the legacy connector in the solution; do not deprecate the solution itself.

Reason for Change(s):

  • Prepare a reviewed transition from the legacy data-lake connector to asset and relationship ingestion into a Log Analytics workspace.
  • Make schema normalization available without twelve separate parser functions.
  • Keep migration explicit: no automatic connection/history migration, no automatic collector shutdown, and no established Purview backend equivalence.

Version Updated:

  • Pending maintainer/user confirmation. Current upstream version remains 3.4.0.
  • Proposed minor version: 3.5.0. No numbered release-note entry or regenerated solution package is included yet; ReleaseNotes.md records the pending draft change.

Testing Completed:

  • Source ConnectorsGenerator build and 604 nonintegration tests passed before export. Generation completed with 0 errors and 15 warnings (nullable fixture fields, ARM64, and unavailable local Kusto emulator). These are source-generator results, not Azure-Sentinel release validation.
  • Ran pwsh .script\local-validation\build-and-validate.ps1 -SolutionName "Microsoft Entra ID Assets" -SkipPackaging -VersionBump none against this solution.
  • JSON/YAML syntax, branding, document links, and available static solution checks passed. The validator's 50 ARM-TTK passes cover the unchanged pre-existing Package files, NOT a regenerated package containing the new connector/parser.
  • The final validation-only run reported 10 validators passed, zero failed, and 12 skipped after restoring dependencies and supplying an isolated Python 3.12 runtime. It does not establish package acceptance.
  • The standard runner skipped KQL discovery on this ARM64 host. A separate x64 run of Validate_SolutionParsersFunctions_HaveValidKql passed for EntraAssetsNormalize.yaml using --arch x64 -p:AppendRuntimeIdentifierToOutputPath=false --filter "DisplayName~EntraAssetsNormalize".
  • Parser YAML uses the packager's supported table:(*) notation plus a validation-only empty datatable. Existing packaging strips the table prefix and omits the validation default, preserving the deployed required T:(*) signature.
  • Verified exact requested display names and generic IDs, all twelve standard output streams, no custom table creation resources, and no temporary version references in current solution files. All 23 collectors' request/authentication/paging/expansion settings and all 13 DCR transformations are unchanged.
  • Selection tests cover all twelve table-to-poller mappings (including two user feeds, four owner paths and two eligibility paths), all-selected defaults, required selection, conditional pollers, setup-only warning, and standalone connection parameter wiring. Existing diagnostic variants retain their previous defaults.
  • .NET Core 3.1 checks and TruffleHog were unavailable. Data Connector schema validation was skipped by the runner, so this is not evidence that the new CCF schema passed.
  • No live Lake Explorer/parser execution, complete end-to-end ingestion test, Azure deployment, or production cutover was performed.

Checked that the validations are passing and have addressed any issues that are present:

  • Need Help / Draft only. Available source checks and the focused parser KQL test pass, but packaging, version confirmation, live runtime validation, and release readiness remain pending.
  • Table onboarding was confirmed for this change. The connector now references the Entra system tables; live routing and collection must still be validated before release.
  • Review Graph beta direct-group-member collection, nested preview scale/completeness, PIM licensing, at-least-once delta reconciliation, and Sunday-week-bucket snapshot version limitations.
  • Coordinate replacement availability and legacy deprecation timing before publishing. Do not disconnect the legacy collector until Purview and other downstream dependency owners approve.
  • The new migration-document hyperlink targets the README added in this PR and becomes publicly available after merge.

Cassidy King added 2 commits October 28, 2026 16:49
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c
@github-actions github-actions Bot added 1P Solution 1P Microsoft-owned Sentinel solution Solution Solution specialty review needed labels Oct 28, 2026
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c
@cassidyking17 cassidyking17 changed the title Add preview Entra ID Assets Graph connector and schema normalization Add Microsoft Entra ID Assets (Preview) connector and parser Oct 28, 2026
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

1P Solution 1P Microsoft-owned Sentinel solution Solution Solution specialty review needed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants