diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json new file mode 100644 index 00000000000..ca9334d7a86 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json @@ -0,0 +1,1127 @@ +{ + "name": "MicrosoftEntraIDAssetsDCR", + "apiVersion": "2023-03-11", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-EntraApplications_CL": { + "columns": [ + { + "name": "appId", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "groupMembershipClaims", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "identifierUris", + "type": "dynamic" + }, + { + "name": "isDeviceOnlyAuthSupported", + "type": "boolean" + }, + { + "name": "isFallbackPublicClient", + "type": "boolean" + }, + { + "name": "notes", + "type": "string" + }, + { + "name": "publisherDomain", + "type": "string" + }, + { + "name": "tags", + "type": "dynamic" + }, + { + "name": "uniqueName", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraDevices_CL": { + "columns": [ + { + "name": "accountEnabled", + "type": "boolean" + }, + { + "name": "alternativeSecurityIds", + "type": "dynamic" + }, + { + "name": "approximateLastSignInDateTime", + "type": "datetime" + }, + { + "name": "deviceCategory", + "type": "string" + }, + { + "name": "deviceId", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "deviceMetadata", + "type": "string" + }, + { + "name": "deviceOwnership", + "type": "string" + }, + { + "name": "deviceVersion", + "type": "int" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "enrollmentProfileName", + "type": "string" + }, + { + "name": "enrollmentType", + "type": "string" + }, + { + "name": "isCompliant", + "type": "boolean" + }, + { + "name": "isManaged", + "type": "boolean" + }, + { + "name": "isRooted", + "type": "boolean" + }, + { + "name": "managementType", + "type": "string" + }, + { + "name": "manufacturer", + "type": "string" + }, + { + "name": "mdmAppId", + "type": "string" + }, + { + "name": "model", + "type": "string" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesSecurityIdentifier", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "operatingSystem", + "type": "string" + }, + { + "name": "operatingSystemVersion", + "type": "string" + }, + { + "name": "physicalIds", + "type": "dynamic" + }, + { + "name": "profileType", + "type": "string" + }, + { + "name": "registrationDateTime", + "type": "datetime" + }, + { + "name": "systemLabels", + "type": "dynamic" + }, + { + "name": "trustType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraGroups_CL": { + "columns": [ + { + "name": "classification", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "expirationDateTime", + "type": "datetime" + }, + { + "name": "groupTypes", + "type": "dynamic" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "isAssignableToRole", + "type": "boolean" + }, + { + "name": "isManagementRestricted", + "type": "boolean" + }, + { + "name": "mail", + "type": "string" + }, + { + "name": "mailEnabled", + "type": "boolean" + }, + { + "name": "mailNickname", + "type": "string" + }, + { + "name": "membershipRule", + "type": "string" + }, + { + "name": "membershipRuleProcessingState", + "type": "string" + }, + { + "name": "onPremisesDomainName", + "type": "string" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesNetBiosName", + "type": "string" + }, + { + "name": "onPremisesSamAccountName", + "type": "string" + }, + { + "name": "onPremisesSecurityIdentifier", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "preferredDataLocation", + "type": "string" + }, + { + "name": "preferredLanguage", + "type": "string" + }, + { + "name": "proxyAddresses", + "type": "dynamic" + }, + { + "name": "renewedDateTime", + "type": "datetime" + }, + { + "name": "securityEnabled", + "type": "boolean" + }, + { + "name": "theme", + "type": "string" + }, + { + "name": "uniqueName", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraOrgContacts_CL": { + "columns": [ + { + "name": "addresses", + "type": "dynamic" + }, + { + "name": "companyName", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "givenName", + "type": "string" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "mail", + "type": "string" + }, + { + "name": "mailNickname", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesProvisioningErrors", + "type": "dynamic" + }, + { + "name": "proxyAddresses", + "type": "dynamic" + }, + { + "name": "surname", + "type": "string" + }, + { + "name": "phones", + "type": "dynamic" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraServicePrincipals_CL": { + "columns": [ + { + "name": "accountEnabled", + "type": "boolean" + }, + { + "name": "alternativeNames", + "type": "dynamic" + }, + { + "name": "appId", + "type": "string" + }, + { + "name": "applicationTemplateId", + "type": "string" + }, + { + "name": "appOwnerOrganizationId", + "type": "string" + }, + { + "name": "appRoleAssignmentRequired", + "type": "boolean" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "homepage", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "loginUrl", + "type": "string" + }, + { + "name": "notes", + "type": "string" + }, + { + "name": "notificationEmailAddresses", + "type": "dynamic" + }, + { + "name": "preferredSingleSignOnMode", + "type": "string" + }, + { + "name": "preferredTokenSigningKeyThumbprint", + "type": "string" + }, + { + "name": "servicePrincipalNames", + "type": "dynamic" + }, + { + "name": "servicePrincipalType", + "type": "string" + }, + { + "name": "tags", + "type": "dynamic" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraUsers_CL": { + "columns": [ + { + "name": "accountEnabled", + "type": "boolean" + }, + { + "name": "ageGroup", + "type": "string" + }, + { + "name": "businessPhones", + "type": "dynamic" + }, + { + "name": "city", + "type": "string" + }, + { + "name": "companyName", + "type": "string" + }, + { + "name": "consentProvidedForMinor", + "type": "string" + }, + { + "name": "country", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "creationType", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "employeeHireDate", + "type": "datetime" + }, + { + "name": "employeeId", + "type": "string" + }, + { + "name": "employeeLeaveDateTime", + "type": "datetime" + }, + { + "name": "employeeType", + "type": "string" + }, + { + "name": "externalUserState", + "type": "string" + }, + { + "name": "externalUserStateChangeDateTime", + "type": "datetime" + }, + { + "name": "faxNumber", + "type": "string" + }, + { + "name": "givenName", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "isManagementRestricted", + "type": "boolean" + }, + { + "name": "isResourceAccount", + "type": "boolean" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "lastPasswordChangeDateTime", + "type": "datetime" + }, + { + "name": "legalAgeGroupClassification", + "type": "string" + }, + { + "name": "mail", + "type": "string" + }, + { + "name": "mailNickname", + "type": "string" + }, + { + "name": "mobilePhone", + "type": "string" + }, + { + "name": "officeLocation", + "type": "string" + }, + { + "name": "onPremisesDistinguishedName", + "type": "string" + }, + { + "name": "onPremisesDomainName", + "type": "string" + }, + { + "name": "onPremisesImmutableId", + "type": "string" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesSamAccountName", + "type": "string" + }, + { + "name": "onPremisesSecurityIdentifier", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "onPremisesUserPrincipalName", + "type": "string" + }, + { + "name": "otherMails", + "type": "dynamic" + }, + { + "name": "passwordPolicies", + "type": "string" + }, + { + "name": "postalCode", + "type": "string" + }, + { + "name": "preferredDataLocation", + "type": "string" + }, + { + "name": "preferredLanguage", + "type": "string" + }, + { + "name": "proxyAddresses", + "type": "dynamic" + }, + { + "name": "showInAddressList", + "type": "boolean" + }, + { + "name": "signInSessionsValidFromDateTime", + "type": "datetime" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "streetAddress", + "type": "string" + }, + { + "name": "surname", + "type": "string" + }, + { + "name": "usageLocation", + "type": "string" + }, + { + "name": "userPrincipalName", + "type": "string" + }, + { + "name": "userType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraOrganizations_CL": { + "columns": [ + { + "name": "businessPhones", + "type": "dynamic" + }, + { + "name": "city", + "type": "string" + }, + { + "name": "country", + "type": "string" + }, + { + "name": "countryLetterCode", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "defaultUsageLocation", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "marketingNotificationEmails", + "type": "dynamic" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "partnerTenantType", + "type": "string" + }, + { + "name": "postalCode", + "type": "string" + }, + { + "name": "preferredLanguage", + "type": "string" + }, + { + "name": "securityComplianceNotificationMails", + "type": "dynamic" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "street", + "type": "string" + }, + { + "name": "technicalNotificationMails", + "type": "dynamic" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraGroupMemberships_CL": { + "columns": [ + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraMembers_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraOwners_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraSponsors_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraEligibleMembers_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraEligibleRoleMembers_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "roleDefinitionId", + "type": "string" + }, + { + "name": "principalId", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "principal", + "type": "dynamic" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "directoryScopeId", + "type": "string" + }, + { + "name": "appScopeId", + "type": "string" + }, + { + "name": "startDateTime", + "type": "datetime" + }, + { + "name": "endDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-EntraApplications_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraApplications", + "transformKql": "source | extend TimeGenerated = now() , AppId = ['appId'] , CreatedDateTime = ['createdDateTime'] , Description = ['description'] , DisplayName = ['displayName'] , GroupMembershipClaims = ['groupMembershipClaims'] , Id = ['id'] , IdentifierUris = ['identifierUris'] , IsDeviceOnlyAuthSupported = ['isDeviceOnlyAuthSupported'] , IsFallbackPublicClient = ['isFallbackPublicClient'] , Notes = ['notes'] , PublisherDomain = ['publisherDomain'] , Tags = ['tags'] , UniqueName = ['uniqueName'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AppId , CreatedDateTime , Description , DisplayName , GroupMembershipClaims , Id , IdentifierUris , IsDeviceOnlyAuthSupported , IsFallbackPublicClient , Notes , PublisherDomain , Tags , UniqueName , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraDevices_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraDevices", + "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AlternativeSecurityIds = ['alternativeSecurityIds'] , ApproximateLastSignInDateTime = ['approximateLastSignInDateTime'] , DeviceCategory = ['deviceCategory'] , DeviceId = ['deviceId'] , Id = ['id'] , DeviceMetadata = ['deviceMetadata'] , DeviceOwnership = ['deviceOwnership'] , DeviceVersion = ['deviceVersion'] , DisplayName = ['displayName'] , EnrollmentProfileName = ['enrollmentProfileName'] , EnrollmentType = ['enrollmentType'] , IsCompliant = ['isCompliant'] , IsManaged = ['isManaged'] , IsRooted = ['isRooted'] , ManagementType = ['managementType'] , Manufacturer = ['manufacturer'] , MdmAppId = ['mdmAppId'] , Model = ['model'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OperatingSystem = ['operatingSystem'] , OperatingSystemVersion = ['operatingSystemVersion'] , PhysicalIds = ['physicalIds'] , ProfileType = ['profileType'] , RegistrationDateTime = ['registrationDateTime'] , SystemLabels = ['systemLabels'] , TrustType = ['trustType'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AlternativeSecurityIds , ApproximateLastSignInDateTime , DeviceCategory , DeviceId , Id , DeviceMetadata , DeviceOwnership , DeviceVersion , DisplayName , EnrollmentProfileName , EnrollmentType , IsCompliant , IsManaged , IsRooted , ManagementType , Manufacturer , MdmAppId , Model , OnPremisesLastSyncDateTime , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , OperatingSystem , OperatingSystemVersion , PhysicalIds , ProfileType , RegistrationDateTime , SystemLabels , TrustType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraGroups_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraGroups", + "transformKql": "source | extend TimeGenerated = now() , Classification = ['classification'] , CreatedDateTime = ['createdDateTime'] , Description = ['description'] , DisplayName = ['displayName'] , ExpirationDateTime = ['expirationDateTime'] , GroupTypes = ['groupTypes'] , Id = ['id'] , IsAssignableToRole = ['isAssignableToRole'] , IsManagementRestricted = ['isManagementRestricted'] , Mail = ['mail'] , MailEnabled = ['mailEnabled'] , MailNickname = ['mailNickname'] , MembershipRule = ['membershipRule'] , MembershipRuleProcessingState = ['membershipRuleProcessingState'] , OnPremisesDomainName = ['onPremisesDomainName'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesNetBiosName = ['onPremisesNetBiosName'] , OnPremisesSamAccountName = ['onPremisesSamAccountName'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , PreferredDataLocation = ['preferredDataLocation'] , PreferredLanguage = ['preferredLanguage'] , ProxyAddresses = ['proxyAddresses'] , RenewedDateTime = ['renewedDateTime'] , SecurityEnabled = ['securityEnabled'] , Theme = ['theme'] , UniqueName = ['uniqueName'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , Classification , CreatedDateTime , Description , DisplayName , ExpirationDateTime , GroupTypes , Id , IsAssignableToRole , IsManagementRestricted , Mail , MailEnabled , MailNickname , MembershipRule , MembershipRuleProcessingState , OnPremisesDomainName , OnPremisesLastSyncDateTime , OnPremisesNetBiosName , OnPremisesSamAccountName , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , PreferredDataLocation , PreferredLanguage , ProxyAddresses , RenewedDateTime , SecurityEnabled , Theme , UniqueName , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraOrgContacts_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraOrgContacts", + "transformKql": "source | extend TimeGenerated = now() , Addresses = ['addresses'] , CompanyName = ['companyName'] , Department = ['department'] , DisplayName = ['displayName'] , GivenName = ['givenName'] , JobTitle = ['jobTitle'] , Mail = ['mail'] , MailNickname = ['mailNickname'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesProvisioningErrors = ['onPremisesProvisioningErrors'] , ProxyAddresses = ['proxyAddresses'] , Surname = ['surname'] , Phones = ['phones'] , Id = ['id'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , Addresses , CompanyName , Department , DisplayName , GivenName , JobTitle , Mail , MailNickname , OnPremisesSyncEnabled , OnPremisesLastSyncDateTime , OnPremisesProvisioningErrors , ProxyAddresses , Surname , Phones , Id , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraServicePrincipals_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraServicePrincipals", + "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AlternativeNames = ['alternativeNames'] , AppId = ['appId'] , ApplicationTemplateId = ['applicationTemplateId'] , AppOwnerOrganizationId = ['appOwnerOrganizationId'] , AppRoleAssignmentRequired = ['appRoleAssignmentRequired'] , Description = ['description'] , DisplayName = ['displayName'] , Homepage = ['homepage'] , Id = ['id'] , LoginUrl = ['loginUrl'] , Notes = ['notes'] , NotificationEmailAddresses = ['notificationEmailAddresses'] , PreferredSingleSignOnMode = ['preferredSingleSignOnMode'] , PreferredTokenSigningKeyThumbprint = ['preferredTokenSigningKeyThumbprint'] , ServicePrincipalNames = ['servicePrincipalNames'] , ServicePrincipalType = ['servicePrincipalType'] , Tags = ['tags'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AlternativeNames , AppId , ApplicationTemplateId , AppOwnerOrganizationId , AppRoleAssignmentRequired , Description , DisplayName , Homepage , Id , LoginUrl , Notes , NotificationEmailAddresses , PreferredSingleSignOnMode , PreferredTokenSigningKeyThumbprint , ServicePrincipalNames , ServicePrincipalType , Tags , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraUsers_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraUsers", + "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AgeGroup = ['ageGroup'] , BusinessPhones = tostring(['businessPhones']) , City = ['city'] , CompanyName = ['companyName'] , ConsentProvidedForMinor = ['consentProvidedForMinor'] , Country = ['country'] , CreatedDateTime = ['createdDateTime'] , CreationType = ['creationType'] , Department = ['department'] , DisplayName = ['displayName'] , EmployeeHireDate = ['employeeHireDate'] , EmployeeId = ['employeeId'] , EmployeeLeaveDateTime = ['employeeLeaveDateTime'] , EmployeeType = ['employeeType'] , ExternalUserState = ['externalUserState'] , ExternalUserStateChangeDateTime = ['externalUserStateChangeDateTime'] , FaxNumber = ['faxNumber'] , GivenName = ['givenName'] , Id = ['id'] , IsManagementRestricted = ['isManagementRestricted'] , IsResourceAccount = ['isResourceAccount'] , JobTitle = ['jobTitle'] , LastPasswordChangeDateTime = ['lastPasswordChangeDateTime'] , LegalAgeGroupClassification = ['legalAgeGroupClassification'] , Mail = ['mail'] , MailNickname = ['mailNickname'] , MobilePhone = ['mobilePhone'] , OfficeLocation = ['officeLocation'] , OnPremisesDistinguishedName = ['onPremisesDistinguishedName'] , OnPremisesDomainName = ['onPremisesDomainName'] , OnPremisesImmutableId = ['onPremisesImmutableId'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSamAccountName = ['onPremisesSamAccountName'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OnPremisesUserPrincipalName = ['onPremisesUserPrincipalName'] , OtherMails = ['otherMails'] , PasswordPolicies = ['passwordPolicies'] , PostalCode = ['postalCode'] , PreferredDataLocation = ['preferredDataLocation'] , PreferredLanguage = ['preferredLanguage'] , ProxyAddresses = ['proxyAddresses'] , ShowInAddressList = ['showInAddressList'] , SignInSessionsValidFromDateTime = ['signInSessionsValidFromDateTime'] , State = ['state'] , StreetAddress = ['streetAddress'] , Surname = ['surname'] , UsageLocation = ['usageLocation'] , UserPrincipalName = ['userPrincipalName'] , UserType = ['userType'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AgeGroup , BusinessPhones , City , CompanyName , ConsentProvidedForMinor , Country , CreatedDateTime , CreationType , Department , DisplayName , EmployeeHireDate , EmployeeId , EmployeeLeaveDateTime , EmployeeType , ExternalUserState , ExternalUserStateChangeDateTime , FaxNumber , GivenName , Id , IsManagementRestricted , IsResourceAccount , JobTitle , LastPasswordChangeDateTime , LegalAgeGroupClassification , Mail , MailNickname , MobilePhone , OfficeLocation , OnPremisesDistinguishedName , OnPremisesDomainName , OnPremisesImmutableId , OnPremisesLastSyncDateTime , OnPremisesSamAccountName , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , OnPremisesUserPrincipalName , OtherMails , PasswordPolicies , PostalCode , PreferredDataLocation , PreferredLanguage , ProxyAddresses , ShowInAddressList , SignInSessionsValidFromDateTime , State , StreetAddress , Surname , UsageLocation , UserPrincipalName , UserType , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraOrganizations_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraOrganizations", + "transformKql": "source | extend TimeGenerated = now() , BusinessPhones = tostring(['businessPhones']) , City = ['city'] , Country = ['country'] , CountryLetterCode = ['countryLetterCode'] , CreatedDateTime = ['createdDateTime'] , DefaultUsageLocation = ['defaultUsageLocation'] , DisplayName = ['displayName'] , Id = ['id'] , MarketingNotificationEmails = ['marketingNotificationEmails'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , PartnerTenantType = ['partnerTenantType'] , PostalCode = ['postalCode'] , PreferredLanguage = ['preferredLanguage'] , SecurityComplianceNotificationMails = ['securityComplianceNotificationMails'] , State = ['state'] , Street = ['street'] , TechnicalNotificationMails = ['technicalNotificationMails'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , BusinessPhones , City , Country , CountryLetterCode , CreatedDateTime , DefaultUsageLocation , DisplayName , Id , MarketingNotificationEmails , OnPremisesLastSyncDateTime , OnPremisesSyncEnabled , PartnerTenantType , PostalCode , PreferredLanguage , SecurityComplianceNotificationMails , State , Street , TechnicalNotificationMails , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraGroupMemberships_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraGroupMemberships", + "transformKql": "source | extend TimeGenerated = now() , AADTenantId = ['aadTenantId'] , SourceId = tostring(group.id) , TargetId = tostring(expand.id) , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , AADTenantId , SourceId , TargetId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraMembers_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraMembers", + "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = tostring(group.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , TargetId = tostring(expand.id) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraOwners_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraOwners", + "transformKql": "source | extend TimeGenerated = now() , SourceId = tostring(group.id) , SourceType = ['sourceType'] , TargetId = tostring(expand.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceId , SourceType , TargetId , TargetType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraSponsors_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraSponsors", + "transformKql": "source | extend TimeGenerated = now() , SourceId = tostring(group.id) , SourceType = ['sourceType'] , TargetId = tostring(expand.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceId , SourceType , TargetId , TargetType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraEligibleMembers_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraEligibleMembers", + "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = tostring(expand.groupId) , TargetType = iff(tostring(expand.principal['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand.principal['@odata.type']), 17), tostring(expand.principal['@odata.type'])) , TargetId = tostring(expand.principalId) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) and tostring(expand.accessId) == 'member' and (isempty(tostring(expand.startDateTime)) or todatetime(expand.startDateTime) <= now()) and (isempty(tostring(expand.endDateTime)) or todatetime(expand.endDateTime) > now()) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraEligibleRoleMembers_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Microsoft-EntraEligibleMembers", + "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = ['roleDefinitionId'] , TargetType = iff(tostring(principal['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(principal['@odata.type']), 17), tostring(principal['@odata.type'])) , TargetId = ['principalId'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where (isnull(startDateTime) or startDateTime <= now()) and (isnull(endDateTime) or endDateTime > now()) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + } + ] + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json new file mode 100644 index 00000000000..1815ba85fa1 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -0,0 +1,428 @@ +{ + "name": "MicrosoftEntraIDAssetsCCF", + "apiVersion": "2025-09-01", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "MicrosoftEntraIDAssetsCCF", + "title": "Microsoft Entra ID Assets", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/AADCloudSync.svg", + "publisher": "Microsoft", + "descriptionMarkdown": "Microsoft Entra assets include users, groups, applications, service principals and devices, together with their membership and ownership relationships. Collect this inventory in Microsoft Sentinel.", + "graphQueries": [ + { + "metricName": "EntraApplications observations", + "legend": "EntraApplications", + "baseQuery": "EntraApplications" + }, + { + "metricName": "EntraDevices observations", + "legend": "EntraDevices", + "baseQuery": "EntraDevices" + }, + { + "metricName": "EntraGroups observations", + "legend": "EntraGroups", + "baseQuery": "EntraGroups" + }, + { + "metricName": "EntraOrgContacts observations", + "legend": "EntraOrgContacts", + "baseQuery": "EntraOrgContacts" + }, + { + "metricName": "EntraServicePrincipals observations", + "legend": "EntraServicePrincipals", + "baseQuery": "EntraServicePrincipals" + }, + { + "metricName": "EntraUsers observations", + "legend": "EntraUsers", + "baseQuery": "EntraUsers" + }, + { + "metricName": "EntraOrganizations observations", + "legend": "EntraOrganizations", + "baseQuery": "EntraOrganizations" + }, + { + "metricName": "EntraGroupMemberships observations", + "legend": "EntraGroupMemberships", + "baseQuery": "EntraGroupMemberships" + }, + { + "metricName": "EntraMembers observations", + "legend": "EntraMembers", + "baseQuery": "EntraMembers" + }, + { + "metricName": "EntraOwners observations", + "legend": "EntraOwners", + "baseQuery": "EntraOwners" + }, + { + "metricName": "EntraSponsors observations", + "legend": "EntraSponsors", + "baseQuery": "EntraSponsors" + }, + { + "metricName": "EntraEligibleMembers observations", + "legend": "EntraEligibleMembers", + "baseQuery": "EntraEligibleMembers" + } + ], + "sampleQueries": [ + { + "description": "Recent EntraApplications", + "query": "EntraApplications | take 100" + }, + { + "description": "EntraApplications freshness", + "query": "EntraApplications | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraDevices", + "query": "EntraDevices | take 100" + }, + { + "description": "EntraDevices freshness", + "query": "EntraDevices | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraGroups", + "query": "EntraGroups | take 100" + }, + { + "description": "EntraGroups freshness", + "query": "EntraGroups | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraOrgContacts", + "query": "EntraOrgContacts | take 100" + }, + { + "description": "EntraOrgContacts freshness", + "query": "EntraOrgContacts | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraServicePrincipals", + "query": "EntraServicePrincipals | take 100" + }, + { + "description": "EntraServicePrincipals freshness", + "query": "EntraServicePrincipals | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraUsers", + "query": "EntraUsers | take 100" + }, + { + "description": "EntraUsers freshness", + "query": "EntraUsers | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraOrganizations", + "query": "EntraOrganizations | take 100" + }, + { + "description": "EntraOrganizations freshness", + "query": "EntraOrganizations | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraGroupMemberships", + "query": "EntraGroupMemberships | take 100" + }, + { + "description": "EntraGroupMemberships freshness", + "query": "EntraGroupMemberships | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraMembers", + "query": "EntraMembers | take 100" + }, + { + "description": "EntraMembers freshness", + "query": "EntraMembers | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraOwners", + "query": "EntraOwners | take 100" + }, + { + "description": "EntraOwners freshness", + "query": "EntraOwners | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraSponsors", + "query": "EntraSponsors | take 100" + }, + { + "description": "EntraSponsors freshness", + "query": "EntraSponsors | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraEligibleMembers", + "query": "EntraEligibleMembers | take 100" + }, + { + "description": "EntraEligibleMembers freshness", + "query": "EntraEligibleMembers | summarize LastObservation=max(TimeGenerated) by AADTenantId" + } + ], + "dataTypes": [ + { + "name": "EntraApplications", + "lastDataReceivedQuery": "EntraApplications\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraDevices", + "lastDataReceivedQuery": "EntraDevices\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraGroups", + "lastDataReceivedQuery": "EntraGroups\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraOrgContacts", + "lastDataReceivedQuery": "EntraOrgContacts\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraServicePrincipals", + "lastDataReceivedQuery": "EntraServicePrincipals\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraUsers", + "lastDataReceivedQuery": "EntraUsers\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraOrganizations", + "lastDataReceivedQuery": "EntraOrganizations\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraGroupMemberships", + "lastDataReceivedQuery": "EntraGroupMemberships\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraMembers", + "lastDataReceivedQuery": "EntraMembers\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraOwners", + "lastDataReceivedQuery": "EntraOwners\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraSponsors", + "lastDataReceivedQuery": "EntraSponsors\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraEligibleMembers", + "lastDataReceivedQuery": "EntraEligibleMembers\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and write permissions are required on the workspace targeted for this connection.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + } + ], + "tenant": [ + "GlobalAdmin", + "SecurityAdmin" + ] + }, + "instructionSteps": [ + { + "description": "Connect Entra asset data.", + "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Setup selection only: changing the selection alone does not stop existing pollers. Disconnect/delete a table's existing pollers before reconnecting with a reduced selection. Include both snapshot/changefeed pollers and all relationship paths. Stored data is retained.", + "visible": true, + "inline": false, + "type": "warning" + } + }, + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Connection", + "columnValue": "properties.addOnAttributes.friendlyName" + }, + { + "columnName": "Tenant", + "columnValue": "properties.addOnAttributes.aadTenantId" + }, + { + "columnName": "Source type", + "columnValue": "properties.addOnAttributes.sourceType" + }, + { + "columnName": "Stream", + "columnValue": "properties.dataType" + } + ], + "menuItems": [ + "DeleteConnector" + ], + "isMultiSelect": true + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add connection", + "title": "Connect Entra assets and relationships", + "subtitle": "Weekly snapshots and hourly deltas", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** This connector is currently in preview, and uses a Graph preview endpoint. Tables will be updated weekly for this Preview connector.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required for the EligibleMembers table. If eligibility fails, other collectors may still be connected; verify their deployment status." + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Tables to collect", + "name": "selectedDataTypes", + "options": [ + { + "key": "EntraApplications", + "text": "EntraApplications" + }, + { + "key": "EntraDevices", + "text": "EntraDevices" + }, + { + "key": "EntraGroups", + "text": "EntraGroups" + }, + { + "key": "EntraOrgContacts", + "text": "EntraOrgContacts" + }, + { + "key": "EntraServicePrincipals", + "text": "EntraServicePrincipals" + }, + { + "key": "EntraUsers", + "text": "EntraUsers" + }, + { + "key": "EntraOrganizations", + "text": "EntraOrganizations" + }, + { + "key": "EntraGroupMemberships", + "text": "EntraGroupMemberships" + }, + { + "key": "EntraMembers", + "text": "EntraMembers" + }, + { + "key": "EntraOwners", + "text": "EntraOwners" + }, + { + "key": "EntraSponsors", + "text": "EntraSponsors" + }, + { + "key": "EntraEligibleMembers", + "text": "EntraEligibleMembers" + } + ], + "placeholder": "Select tables to collect...", + "isMultiSelect": true, + "defaultAllSelected": true, + "required": true + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Connection name", + "placeholder": "Unique name", + "type": "text", + "name": "friendlyName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Tenant ID", + "placeholder": "Tenant GUID", + "type": "text", + "name": "tenantId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Application client ID", + "placeholder": "Application GUID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client secret", + "placeholder": "Secret value", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json new file mode 100644 index 00000000000..35e22e3f576 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json @@ -0,0 +1,1972 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupMemberships' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups/$parentId$/transitiveMembers/microsoft.graph.user", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json", + "ConsistencyLevel": "eventual" + }, + "queryParameters": { + "$select": "id", + "$top": "999", + "$count": "true" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParaName": "$top", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraGroupMemberships", + "dcrConfig": { + "streamName": "Custom-EntraGroupMemberships_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraGroupMemberships')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/beta/groups/$parentId$/members", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraMembers", + "dcrConfig": { + "streamName": "Custom-EntraMembers_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraMembers')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFRoleMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/directoryRoles", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/directoryRoles", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/directoryRoles/$parentId$/members", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraMembers", + "dcrConfig": { + "streamName": "Custom-EntraMembers_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "role", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraMembers')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups/$parentId$/owners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", + "dcrConfig": { + "streamName": "Custom-EntraOwners_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFApplicationOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications/$parentId$/owners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", + "dcrConfig": { + "streamName": "Custom-EntraOwners_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "application", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFServicePrincipalOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals/$parentId$/owners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", + "dcrConfig": { + "streamName": "Custom-EntraOwners_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "servicePrincipal", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFDeviceOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices/$parentId$/registeredOwners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", + "dcrConfig": { + "streamName": "Custom-EntraOwners_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "device", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFUserSponsors' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users/$parentId$/sponsors", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraSponsors", + "dcrConfig": { + "streamName": "Custom-EntraSponsors_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "user", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraSponsors')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFEligibleGroupMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$filter": "principalId eq '$parentId$'", + "$expand": "principal($select=id)" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraEligibleMembers", + "dcrConfig": { + "streamName": "Custom-EntraEligibleMembers_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraEligibleMembers')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFEligibleRoleMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleInstances", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id,roleDefinitionId,principalId,directoryScopeId,appScopeId,startDateTime,endDateTime", + "$expand": "principal($select=id)" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleInstances", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": {} + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraEligibleMembers", + "dcrConfig": { + "streamName": "Custom-EntraEligibleRoleMembers_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "roleDefinition", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraEligibleMembers')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFApplicationsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "appId,createdDateTime,description,displayName,groupMembershipClaims,id,identifierUris,isDeviceOnlyAuthSupported,isFallbackPublicClient,notes,publisherDomain,tags,uniqueName,deletedDateTime", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraApplications", + "dcrConfig": { + "streamName": "Custom-EntraApplications_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraApplications')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFApplicationsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "appId,createdDateTime,description,displayName,groupMembershipClaims,id,identifierUris,isDeviceOnlyAuthSupported,isFallbackPublicClient,notes,publisherDomain,tags,uniqueName,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraApplications", + "dcrConfig": { + "streamName": "Custom-EntraApplications_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraApplications')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFDevicesSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeSecurityIds,approximateLastSignInDateTime,deviceCategory,deviceId,id,deviceMetadata,deviceOwnership,deviceVersion,displayName,enrollmentProfileName,enrollmentType,isCompliant,isManaged,isRooted,managementType,manufacturer,mdmAppId,model,onPremisesLastSyncDateTime,onPremisesSecurityIdentifier,onPremisesSyncEnabled,operatingSystem,operatingSystemVersion,physicalIds,profileType,registrationDateTime,systemLabels,trustType", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraDevices", + "dcrConfig": { + "streamName": "Custom-EntraDevices_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraDevices')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFDevicesChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeSecurityIds,approximateLastSignInDateTime,deviceCategory,deviceId,id,deviceMetadata,deviceOwnership,deviceVersion,displayName,enrollmentProfileName,enrollmentType,isCompliant,isManaged,isRooted,managementType,manufacturer,mdmAppId,model,onPremisesLastSyncDateTime,onPremisesSecurityIdentifier,onPremisesSyncEnabled,operatingSystem,operatingSystemVersion,physicalIds,profileType,registrationDateTime,systemLabels,trustType", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraDevices", + "dcrConfig": { + "streamName": "Custom-EntraDevices_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraDevices')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "classification,createdDateTime,description,displayName,expirationDateTime,groupTypes,id,isAssignableToRole,isManagementRestricted,mail,mailEnabled,mailNickname,membershipRule,membershipRuleProcessingState,onPremisesDomainName,onPremisesLastSyncDateTime,onPremisesNetBiosName,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,preferredDataLocation,preferredLanguage,proxyAddresses,renewedDateTime,securityEnabled,theme,uniqueName,deletedDateTime", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraGroups", + "dcrConfig": { + "streamName": "Custom-EntraGroups_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraGroups')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "classification,createdDateTime,description,displayName,expirationDateTime,groupTypes,id,isAssignableToRole,isManagementRestricted,mail,mailEnabled,mailNickname,membershipRule,membershipRuleProcessingState,onPremisesDomainName,onPremisesLastSyncDateTime,onPremisesNetBiosName,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,preferredDataLocation,preferredLanguage,proxyAddresses,renewedDateTime,securityEnabled,theme,uniqueName,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraGroups", + "dcrConfig": { + "streamName": "Custom-EntraGroups_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraGroups')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFOrgContactsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "addresses,companyName,department,displayName,givenName,jobTitle,mail,mailNickname,onPremisesSyncEnabled,onPremisesLastSyncDateTime,onPremisesProvisioningErrors,proxyAddresses,surname,phones,id", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOrgContacts", + "dcrConfig": { + "streamName": "Custom-EntraOrgContacts_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOrgContacts')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFOrgContactsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "addresses,companyName,department,displayName,givenName,jobTitle,mail,mailNickname,onPremisesSyncEnabled,onPremisesLastSyncDateTime,onPremisesProvisioningErrors,proxyAddresses,surname,phones,id", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOrgContacts", + "dcrConfig": { + "streamName": "Custom-EntraOrgContacts_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOrgContacts')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFServicePrincipalsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeNames,appId,applicationTemplateId,appOwnerOrganizationId,appRoleAssignmentRequired,description,displayName,homepage,id,loginUrl,notes,notificationEmailAddresses,preferredSingleSignOnMode,preferredTokenSigningKeyThumbprint,servicePrincipalNames,servicePrincipalType,tags,deletedDateTime", + "$top": "100" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 100, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraServicePrincipals", + "dcrConfig": { + "streamName": "Custom-EntraServicePrincipals_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraServicePrincipals')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFServicePrincipalsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeNames,appId,applicationTemplateId,appOwnerOrganizationId,appRoleAssignmentRequired,description,displayName,homepage,id,loginUrl,notes,notificationEmailAddresses,preferredSingleSignOnMode,preferredTokenSigningKeyThumbprint,servicePrincipalNames,servicePrincipalType,tags,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraServicePrincipals", + "dcrConfig": { + "streamName": "Custom-EntraServicePrincipals_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraServicePrincipals')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFUsersSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,ageGroup,businessPhones,city,companyName,consentProvidedForMinor,country,createdDateTime,creationType,department,displayName,employeeHireDate,employeeId,employeeLeaveDateTime,employeeType,externalUserState,externalUserStateChangeDateTime,faxNumber,givenName,id,isManagementRestricted,isResourceAccount,jobTitle,lastPasswordChangeDateTime,legalAgeGroupClassification,mail,mailNickname,mobilePhone,officeLocation,onPremisesDistinguishedName,onPremisesDomainName,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,onPremisesUserPrincipalName,otherMails,passwordPolicies,postalCode,preferredDataLocation,preferredLanguage,proxyAddresses,showInAddressList,signInSessionsValidFromDateTime,state,streetAddress,surname,usageLocation,userPrincipalName,userType,deletedDateTime", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraUsers", + "dcrConfig": { + "streamName": "Custom-EntraUsers_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraUsers')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFUsersChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,ageGroup,businessPhones,city,companyName,consentProvidedForMinor,country,createdDateTime,creationType,department,displayName,employeeHireDate,employeeId,employeeLeaveDateTime,employeeType,externalUserState,externalUserStateChangeDateTime,faxNumber,givenName,id,isManagementRestricted,isResourceAccount,jobTitle,lastPasswordChangeDateTime,legalAgeGroupClassification,mail,mailNickname,mobilePhone,officeLocation,onPremisesDistinguishedName,onPremisesDomainName,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,onPremisesUserPrincipalName,otherMails,passwordPolicies,postalCode,preferredDataLocation,preferredLanguage,proxyAddresses,showInAddressList,signInSessionsValidFromDateTime,state,streetAddress,surname,usageLocation,userPrincipalName,userType,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraUsers", + "dcrConfig": { + "streamName": "Custom-EntraUsers_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraUsers')]" + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFOrganizationsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/organization", + "httpMethod": "GET", + "rateLimitQPS": 1, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "businessPhones,city,country,countryLetterCode,createdDateTime,defaultUsageLocation,displayName,id,marketingNotificationEmails,onPremisesLastSyncDateTime,onPremisesSyncEnabled,partnerTenantType,postalCode,preferredLanguage,securityComplianceNotificationMails,state,street,technicalNotificationMails" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/organization", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOrganizations", + "dcrConfig": { + "streamName": "Custom-EntraOrganizations_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOrganizations')]" + } +] \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json index 29ea37f505a..ae02bfed70a 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json @@ -1,9 +1,9 @@ { "id": "EntraIDAssets", - "title": "Microsoft Entra ID Assets", + "title": "[Deprecated] Microsoft Entra ID Assets", "publisher": "Microsoft", "logo": "AADCloudSync.svg", - "descriptionMarkdown": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", + "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Microsoft Entra ID Assets**, marked **Preview** in the gallery, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", "graphQueries": [], "sampleQueries": [], "dataTypes": [], diff --git a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json index 11bc241a0e7..0d10e6dc569 100644 --- a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json +++ b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json @@ -2,9 +2,13 @@ "Name": "Microsoft Entra ID Assets", "Author": "Microsoft", "Logo": "", - "Description": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", + "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. The preview Microsoft Entra ID Assets connector ingests inventory into onboarded Entra system tables in a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes Parser for Microsoft Entra ID Assets for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).", "Data Connectors": [ - "Data Connectors/EntraIDAssets_DataConnectorDefinition.json" + "Data Connectors/EntraIDAssets_DataConnectorDefinition.json", + "Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json" + ], + "Parsers": [ + "Parsers/EntraAssetsNormalize.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Entra ID Assets", "Version": "3.4.0", diff --git a/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml new file mode 100644 index 00000000000..3686716882f --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml @@ -0,0 +1,151 @@ +Function: + Title: Parser for Microsoft Entra ID Assets + Version: '1.0.0' + LastUpdated: '2026-10-28' +Product: Microsoft Entra ID +Description: | + Normalizes legacy camelCase and current PascalCase Entra asset and relationship data + to a shared PascalCase schema at query time without modifying stored data. + Existing PascalCase columns take precedence by column presence, including null and + empty values. Fields absent from the source remain empty or null. + Legacy data must already be queryable in the environment where the function runs. + This does not migrate data or reconstruct snapshot or changefeed state. +FunctionName: EntraAssetsNormalize +FunctionAlias: EntraAssetsNormalize +Function Title: Parser for Microsoft Entra ID Assets +FunctionParams: + - Name: T + Type: 'table:(*)' + # Used by KQL validation only; packaging omits defaults for tabular parameters. + Default: 'datatable(_ValidationOnly:string)[]' +Category: Microsoft Sentinel Parser +id: acfde93c-7e63-4877-870a-2d11e2806f37 +FunctionQuery: | + T + | project + AppId = tostring(column_ifexists('AppId', column_ifexists('appId', ''))), + CreatedDateTime = todatetime(column_ifexists('CreatedDateTime', column_ifexists('createdDateTime', datetime(null)))), + Description = tostring(column_ifexists('Description', column_ifexists('description', ''))), + DisplayName = tostring(column_ifexists('DisplayName', column_ifexists('displayName', ''))), + GroupMembershipClaims = tostring(column_ifexists('GroupMembershipClaims', column_ifexists('groupMembershipClaims', ''))), + Id = tostring(column_ifexists('Id', column_ifexists('id', ''))), + IdentifierUris = todynamic(column_ifexists('IdentifierUris', column_ifexists('identifierUris', dynamic(null)))), + IsDeviceOnlyAuthSupported = tobool(column_ifexists('IsDeviceOnlyAuthSupported', column_ifexists('isDeviceOnlyAuthSupported', bool(null)))), + IsFallbackPublicClient = tobool(column_ifexists('IsFallbackPublicClient', column_ifexists('isFallbackPublicClient', bool(null)))), + Notes = tostring(column_ifexists('Notes', column_ifexists('notes', ''))), + PublisherDomain = tostring(column_ifexists('PublisherDomain', column_ifexists('publisherDomain', ''))), + Tags = todynamic(column_ifexists('Tags', column_ifexists('tags', dynamic(null)))), + UniqueName = tostring(column_ifexists('UniqueName', column_ifexists('uniqueName', ''))), + AADTenantId = tostring(column_ifexists('AADTenantId', column_ifexists('aadTenantId', column_ifexists('tenantId', '')))), + DeletedDateTime = todatetime(column_ifexists('DeletedDateTime', column_ifexists('deletedDateTime', datetime(null)))), + TimeGenerated = todatetime(column_ifexists('TimeGenerated', column_ifexists('timeGenerated', datetime(null)))), + FeedType = tostring(column_ifexists('FeedType', column_ifexists('feedType', ''))), + FeedTypeVersion = tostring(column_ifexists('FeedTypeVersion', column_ifexists('feedTypeVersion', ''))), + IsAssetRemoved = tobool(column_ifexists('IsAssetRemoved', column_ifexists('isAssetRemoved', bool(null)))), + AccountEnabled = tobool(column_ifexists('AccountEnabled', column_ifexists('accountEnabled', bool(null)))), + AlternativeSecurityIds = todynamic(column_ifexists('AlternativeSecurityIds', column_ifexists('alternativeSecurityIds', dynamic(null)))), + ApproximateLastSignInDateTime = todatetime(column_ifexists('ApproximateLastSignInDateTime', column_ifexists('approximateLastSignInDateTime', datetime(null)))), + DeviceCategory = tostring(column_ifexists('DeviceCategory', column_ifexists('deviceCategory', ''))), + DeviceId = tostring(column_ifexists('DeviceId', column_ifexists('deviceId', ''))), + DeviceMetadata = tostring(column_ifexists('DeviceMetadata', column_ifexists('deviceMetadata', ''))), + DeviceOwnership = tostring(column_ifexists('DeviceOwnership', column_ifexists('deviceOwnership', ''))), + DeviceVersion = toint(column_ifexists('DeviceVersion', column_ifexists('deviceVersion', int(null)))), + EnrollmentProfileName = tostring(column_ifexists('EnrollmentProfileName', column_ifexists('enrollmentProfileName', ''))), + EnrollmentType = tostring(column_ifexists('EnrollmentType', column_ifexists('enrollmentType', ''))), + IsCompliant = tobool(column_ifexists('IsCompliant', column_ifexists('isCompliant', bool(null)))), + IsManaged = tobool(column_ifexists('IsManaged', column_ifexists('isManaged', bool(null)))), + IsRooted = tobool(column_ifexists('IsRooted', column_ifexists('isRooted', bool(null)))), + ManagementType = tostring(column_ifexists('ManagementType', column_ifexists('managementType', ''))), + Manufacturer = tostring(column_ifexists('Manufacturer', column_ifexists('manufacturer', ''))), + MdmAppId = tostring(column_ifexists('MdmAppId', column_ifexists('mdmAppId', ''))), + Model = tostring(column_ifexists('Model', column_ifexists('model', ''))), + OnPremisesLastSyncDateTime = todatetime(column_ifexists('OnPremisesLastSyncDateTime', column_ifexists('onPremisesLastSyncDateTime', datetime(null)))), + OnPremisesSecurityIdentifier = tostring(column_ifexists('OnPremisesSecurityIdentifier', column_ifexists('onPremisesSecurityIdentifier', ''))), + OnPremisesSyncEnabled = tobool(column_ifexists('OnPremisesSyncEnabled', column_ifexists('onPremisesSyncEnabled', bool(null)))), + OperatingSystem = tostring(column_ifexists('OperatingSystem', column_ifexists('operatingSystem', ''))), + OperatingSystemVersion = tostring(column_ifexists('OperatingSystemVersion', column_ifexists('operatingSystemVersion', ''))), + PhysicalIds = todynamic(column_ifexists('PhysicalIds', column_ifexists('physicalIds', dynamic(null)))), + ProfileType = tostring(column_ifexists('ProfileType', column_ifexists('profileType', ''))), + RegistrationDateTime = todatetime(column_ifexists('RegistrationDateTime', column_ifexists('registrationDateTime', datetime(null)))), + SystemLabels = todynamic(column_ifexists('SystemLabels', column_ifexists('systemLabels', dynamic(null)))), + TrustType = tostring(column_ifexists('TrustType', column_ifexists('trustType', ''))), + Classification = tostring(column_ifexists('Classification', column_ifexists('classification', ''))), + ExpirationDateTime = todatetime(column_ifexists('ExpirationDateTime', column_ifexists('expirationDateTime', datetime(null)))), + GroupTypes = todynamic(column_ifexists('GroupTypes', column_ifexists('groupTypes', dynamic(null)))), + IsAssignableToRole = tobool(column_ifexists('IsAssignableToRole', column_ifexists('isAssignableToRole', bool(null)))), + IsManagementRestricted = tobool(column_ifexists('IsManagementRestricted', column_ifexists('isManagementRestricted', bool(null)))), + Mail = tostring(column_ifexists('Mail', column_ifexists('mail', ''))), + MailEnabled = tobool(column_ifexists('MailEnabled', column_ifexists('mailEnabled', bool(null)))), + MailNickname = tostring(column_ifexists('MailNickname', column_ifexists('mailNickname', ''))), + MembershipRule = tostring(column_ifexists('MembershipRule', column_ifexists('membershipRule', ''))), + MembershipRuleProcessingState = tostring(column_ifexists('MembershipRuleProcessingState', column_ifexists('membershipRuleProcessingState', ''))), + OnPremisesDomainName = tostring(column_ifexists('OnPremisesDomainName', column_ifexists('onPremisesDomainName', ''))), + OnPremisesNetBiosName = tostring(column_ifexists('OnPremisesNetBiosName', column_ifexists('onPremisesNetBiosName', ''))), + OnPremisesSamAccountName = tostring(column_ifexists('OnPremisesSamAccountName', column_ifexists('onPremisesSamAccountName', ''))), + PreferredDataLocation = tostring(column_ifexists('PreferredDataLocation', column_ifexists('preferredDataLocation', ''))), + PreferredLanguage = tostring(column_ifexists('PreferredLanguage', column_ifexists('preferredLanguage', ''))), + ProxyAddresses = todynamic(column_ifexists('ProxyAddresses', column_ifexists('proxyAddresses', dynamic(null)))), + RenewedDateTime = todatetime(column_ifexists('RenewedDateTime', column_ifexists('renewedDateTime', datetime(null)))), + SecurityEnabled = tobool(column_ifexists('SecurityEnabled', column_ifexists('securityEnabled', bool(null)))), + Theme = tostring(column_ifexists('Theme', column_ifexists('theme', ''))), + Addresses = todynamic(column_ifexists('Addresses', column_ifexists('addresses', dynamic(null)))), + CompanyName = tostring(column_ifexists('CompanyName', column_ifexists('companyName', ''))), + Department = tostring(column_ifexists('Department', column_ifexists('department', ''))), + GivenName = tostring(column_ifexists('GivenName', column_ifexists('givenName', ''))), + JobTitle = tostring(column_ifexists('JobTitle', column_ifexists('jobTitle', ''))), + OnPremisesProvisioningErrors = todynamic(column_ifexists('OnPremisesProvisioningErrors', column_ifexists('onPremisesProvisioningErrors', dynamic(null)))), + Surname = tostring(column_ifexists('Surname', column_ifexists('surname', ''))), + Phones = todynamic(column_ifexists('Phones', column_ifexists('phones', dynamic(null)))), + AlternativeNames = todynamic(column_ifexists('AlternativeNames', column_ifexists('alternativeNames', dynamic(null)))), + ApplicationTemplateId = tostring(column_ifexists('ApplicationTemplateId', column_ifexists('applicationTemplateId', ''))), + AppOwnerOrganizationId = tostring(column_ifexists('AppOwnerOrganizationId', column_ifexists('appOwnerOrganizationId', ''))), + AppRoleAssignmentRequired = tobool(column_ifexists('AppRoleAssignmentRequired', column_ifexists('appRoleAssignmentRequired', bool(null)))), + Homepage = tostring(column_ifexists('Homepage', column_ifexists('homepage', ''))), + LoginUrl = tostring(column_ifexists('LoginUrl', column_ifexists('loginUrl', ''))), + NotificationEmailAddresses = todynamic(column_ifexists('NotificationEmailAddresses', column_ifexists('notificationEmailAddresses', dynamic(null)))), + PreferredSingleSignOnMode = tostring(column_ifexists('PreferredSingleSignOnMode', column_ifexists('preferredSingleSignOnMode', ''))), + PreferredTokenSigningKeyThumbprint = tostring(column_ifexists('PreferredTokenSigningKeyThumbprint', column_ifexists('preferredTokenSigningKeyThumbprint', ''))), + ServicePrincipalNames = todynamic(column_ifexists('ServicePrincipalNames', column_ifexists('servicePrincipalNames', dynamic(null)))), + ServicePrincipalType = tostring(column_ifexists('ServicePrincipalType', column_ifexists('servicePrincipalType', ''))), + AgeGroup = tostring(column_ifexists('AgeGroup', column_ifexists('ageGroup', ''))), + BusinessPhones = tostring(column_ifexists('BusinessPhones', column_ifexists('businessPhones', ''))), + City = tostring(column_ifexists('City', column_ifexists('city', ''))), + ConsentProvidedForMinor = tostring(column_ifexists('ConsentProvidedForMinor', column_ifexists('consentProvidedForMinor', ''))), + Country = tostring(column_ifexists('Country', column_ifexists('country', ''))), + CreationType = tostring(column_ifexists('CreationType', column_ifexists('creationType', ''))), + EmployeeHireDate = todatetime(column_ifexists('EmployeeHireDate', column_ifexists('employeeHireDate', datetime(null)))), + EmployeeId = tostring(column_ifexists('EmployeeId', column_ifexists('employeeId', ''))), + EmployeeLeaveDateTime = todatetime(column_ifexists('EmployeeLeaveDateTime', column_ifexists('employeeLeaveDateTime', datetime(null)))), + EmployeeType = tostring(column_ifexists('EmployeeType', column_ifexists('employeeType', ''))), + ExternalUserState = tostring(column_ifexists('ExternalUserState', column_ifexists('externalUserState', ''))), + ExternalUserStateChangeDateTime = todatetime(column_ifexists('ExternalUserStateChangeDateTime', column_ifexists('externalUserStateChangeDateTime', datetime(null)))), + FaxNumber = tostring(column_ifexists('FaxNumber', column_ifexists('faxNumber', ''))), + IsResourceAccount = tobool(column_ifexists('IsResourceAccount', column_ifexists('isResourceAccount', bool(null)))), + LastPasswordChangeDateTime = todatetime(column_ifexists('LastPasswordChangeDateTime', column_ifexists('lastPasswordChangeDateTime', datetime(null)))), + LegalAgeGroupClassification = tostring(column_ifexists('LegalAgeGroupClassification', column_ifexists('legalAgeGroupClassification', ''))), + MobilePhone = tostring(column_ifexists('MobilePhone', column_ifexists('mobilePhone', ''))), + OfficeLocation = tostring(column_ifexists('OfficeLocation', column_ifexists('officeLocation', ''))), + OnPremisesDistinguishedName = tostring(column_ifexists('OnPremisesDistinguishedName', column_ifexists('onPremisesDistinguishedName', ''))), + OnPremisesImmutableId = tostring(column_ifexists('OnPremisesImmutableId', column_ifexists('onPremisesImmutableId', ''))), + OnPremisesUserPrincipalName = tostring(column_ifexists('OnPremisesUserPrincipalName', column_ifexists('onPremisesUserPrincipalName', ''))), + OtherMails = todynamic(column_ifexists('OtherMails', column_ifexists('otherMails', dynamic(null)))), + PasswordPolicies = tostring(column_ifexists('PasswordPolicies', column_ifexists('passwordPolicies', ''))), + PostalCode = tostring(column_ifexists('PostalCode', column_ifexists('postalCode', ''))), + ShowInAddressList = tobool(column_ifexists('ShowInAddressList', column_ifexists('showInAddressList', bool(null)))), + SignInSessionsValidFromDateTime = todatetime(column_ifexists('SignInSessionsValidFromDateTime', column_ifexists('signInSessionsValidFromDateTime', datetime(null)))), + State = tostring(column_ifexists('State', column_ifexists('state', ''))), + StreetAddress = tostring(column_ifexists('StreetAddress', column_ifexists('streetAddress', ''))), + UsageLocation = tostring(column_ifexists('UsageLocation', column_ifexists('usageLocation', ''))), + UserPrincipalName = tostring(column_ifexists('UserPrincipalName', column_ifexists('userPrincipalName', ''))), + UserType = tostring(column_ifexists('UserType', column_ifexists('userType', ''))), + CountryLetterCode = tostring(column_ifexists('CountryLetterCode', column_ifexists('countryLetterCode', ''))), + DefaultUsageLocation = tostring(column_ifexists('DefaultUsageLocation', column_ifexists('defaultUsageLocation', ''))), + MarketingNotificationEmails = todynamic(column_ifexists('MarketingNotificationEmails', column_ifexists('marketingNotificationEmails', dynamic(null)))), + PartnerTenantType = tostring(column_ifexists('PartnerTenantType', column_ifexists('partnerTenantType', ''))), + SecurityComplianceNotificationMails = todynamic(column_ifexists('SecurityComplianceNotificationMails', column_ifexists('securityComplianceNotificationMails', dynamic(null)))), + Street = tostring(column_ifexists('Street', column_ifexists('street', ''))), + TechnicalNotificationMails = todynamic(column_ifexists('TechnicalNotificationMails', column_ifexists('technicalNotificationMails', dynamic(null)))), + SourceId = tostring(column_ifexists('SourceId', column_ifexists('sourceId', ''))), + TargetId = tostring(column_ifexists('TargetId', column_ifexists('targetId', ''))), + SourceType = tostring(column_ifexists('SourceType', column_ifexists('sourceType', ''))), + TargetType = tostring(column_ifexists('TargetType', column_ifexists('targetType', ''))) diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md new file mode 100644 index 00000000000..d0f19e75d2e --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -0,0 +1,153 @@ +# Microsoft Entra ID Assets + +This solution contains the legacy data-lake connector, **Microsoft Entra ID Assets** +for Azure Log Analytics (marked Preview by the portal), and one shared schema-normalization +parser. Deprecation applies to the legacy connector, not to the solution. + +> **Draft preview:** The new connector references the onboarded Microsoft-managed +> Entra tables. Release readiness and coordinated publication of the replacement +> and deprecation notice require maintainer review. No retirement date or automatic +> cutover is established by this draft. + +## Set up the Graph connector + +The connection requires read and write permissions on the target workspace and +the Microsoft Entra Global Administrator or Security Administrator tenant role. + +1. Install the solution in a Microsoft Sentinel-enabled Log Analytics workspace and + open **Microsoft Entra ID Assets** with the portal's **Preview** label. +2. In the workspace's deployment tenant, register a single-tenant Microsoft Entra app. + No redirect URI is required. Copy its Application (client) ID, not its Object ID. +3. Add Microsoft Graph **application** permissions and grant administrator consent: + `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, + `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, + `Organization.Read.All`, `RoleManagement.Read.Directory`, + `RoleEligibilitySchedule.Read.Directory`, and + `PrivilegedEligibilitySchedule.Read.AzureADGroup`. + Add `Member.Read.Hidden` when collecting hidden memberships. +4. Create a client secret and copy its **Value**, not its Secret ID. Store it securely + and rotate it before expiration. Provide a unique connection name, tenant ID, + application client ID, and secret through the connector's **Add connection** pane. +5. In **Tables to collect**, select at least one table. All twelve are selected by + default. Selecting an asset table enables both its snapshot and hourly changefeed + where supported; selecting a relationship table enables all its collection paths. +6. Check each selected collector's deployment status and table freshness. Collecting + `EntraEligibleMembers` requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. + Leave it unselected if that dataset is not needed or the tenant is not licensed. + A failed eligibility + collector does not establish that the other collectors failed or succeeded. + +The connector supports multiple named connections. With every table selected, it +uses 23 pollers: 17 weekly snapshot paths and six hourly asset changefeeds. Only +pollers for the tables selected during setup are deployed. +The connector page summarizes weekly preview updates; this wording does not disable +the six existing hourly changefeeds. + +### Change or stop collection + +**Tables to collect is a setup selector, not a live on/off switch.** Unchecking a +previously enabled table does not stop or delete its existing pollers. To stop it, +select and delete all poller rows for that table and connection in the connections +grid, including both snapshot/changefeed rows or every relationship path. Reconnect +with the desired selection as needed. Changing the connection name creates a separate +connection; it does not stop the old one. + +Existing table data is retained. In-flight work may still complete after disconnect. + +| Dataset | System table | Collection | +| --- | --- | --- | +| Applications | `EntraApplications` | Weekly snapshot; hourly changes | +| Devices | `EntraDevices` | Weekly snapshot; hourly changes | +| Groups | `EntraGroups` | Weekly snapshot; hourly changes | +| Organizational contacts | `EntraOrgContacts` | Weekly snapshot; hourly changes | +| Service principals | `EntraServicePrincipals` | Weekly snapshot; hourly changes | +| Users | `EntraUsers` | Weekly snapshot; hourly changes | +| Organizations | `EntraOrganizations` | Weekly snapshot | +| Transitive group user memberships | `EntraGroupMemberships` | Weekly snapshot | +| Direct members | `EntraMembers` | Weekly snapshot | +| Owners | `EntraOwners` | Weekly snapshot | +| Sponsors | `EntraSponsors` | Weekly snapshot | +| Eligible members | `EntraEligibleMembers` | Weekly snapshot | + +Use the table names above in queries and poller data types. The DCR routes raw Graph +custom input streams to standard output streams such as `Microsoft-EntraApplications`. +Custom input stream declarations describe the Graph payload; they are not custom +workspace tables. No custom table creation resources are included. +The new connector's internal ID is `MicrosoftEntraIDAssetsCCF`; the legacy connector's +existing ID remains unchanged. + +### Collection limitations + +- Hourly changefeeds start with `$deltatoken=latest`, not an initial full enumeration. + Continuation and delta links are persisted. Snapshots provide the separate baseline; + consumers must reconcile changes, deletion tombstones, and at-least-once delivery. +- `FeedTypeVersion` is a string containing the Sunday UTC calendar-week bucket for + snapshot rows; it is empty for changefeed rows. It is not a unique crawl ID or a + completion watermark. Same-week runs share a bucket and a run crossing the week + boundary can span two buckets. +- Nested collection is preview. Group parent paging uses Graph's default page size; + transitive user membership children use `$top=999` and eventual consistency. + Prior paging checks do not establish complete collection at production scale. +- Direct group-member collection uses Microsoft Graph **beta** to include service + principals. Beta APIs are not supported for production applications. +- Sponsors, transitive memberships, and eligibility snapshots can take days in large + tenants. The connector's five-day estimate is not a maximum or SLA. Early rows do + not establish snapshot completion. +- Complete end-to-end ingestion and live parser execution have not been established by this + draft. Validate in a nonproduction workspace before planning a production cutover. + +## Schema normalization + +**Parser for Microsoft Entra ID Assets** installs the single function +`EntraAssetsNormalize(T:(*))`. It accepts a queryable asset or relationship table and +converts legacy camelCase fields to the PascalCase names and types used by the new +connector. It also accepts existing PascalCase input. + +```kusto +EntraUsers +| invoke EntraAssetsNormalize() +| project Id, DisplayName, AADTenantId, AccountEnabled +``` + +The output is a shared 126-column schema; project the dataset-specific fields needed +by your query. Nonapplicable fields remain empty or null. PascalCase columns take +precedence by **column presence**, including explicit nulls, false, zero, and empty +values. Source tenant mapping accepts `AADTenantId`, `aadTenantId`, or `tenantId`, +never the Log Analytics workspace `TenantId`. Device `Id` is not inferred from +`DeviceId`. Extra legacy fields are not retained, and missing feed metadata is not +invented. + +This is query-time adaptation, not physical migration, data transport, automatic +query rewriting, or snapshot/changefeed reconstruction. Installing a Log Analytics +function does not establish its availability in the data-lake query engine. To +validate against existing lake system tables, first confirm supported function +syntax and data access in that environment; the query body can be tried as an inline +tabular function. Lake execution remains unverified. + +## Migrate from the legacy connector + +1. Inventory existing queries and downstream dependencies, especially Purview data + risk graphs. The new Log Analytics connector is **not established as an equivalent + backend for those graphs**. Do not disconnect their source without owner confirmation. +2. Configure the replacement in a nonproduction workspace. Review permissions, + licensing, preview/beta limitations, and Log Analytics ingestion and retention costs. +3. Verify every required dataset, paging, identity and field mappings, baseline + completeness, delta reconciliation, and freshness. Review affected queries for the + new table names, PascalCase fields, and changed collection semantics. +4. Where needed, use the normalization parser for accessible legacy data. It does not + move historical data into Log Analytics or make unchanged legacy queries compatible. +5. Only after validation and dependency approval, explicitly disconnect the legacy + collector using its existing controls. A Content Hub update or deprecation label + does not stop existing collection or migrate connections and historical data. + +Keep the legacy connector available for existing installations during review. This +draft does not remove its resource identity, instructions, connectivity checks, or +disconnect capability, and does not promise that it is hidden from new users. + +## References + +- [Microsoft Graph delta query](https://learn.microsoft.com/en-us/graph/delta-query-overview) +- [Direct group members and beta workaround](https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0) +- [PIM licensing](https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals) +- [Log Analytics cost management](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs) +- [Purview data risk graphs](https://go.microsoft.com/fwlink/?linkid=2320023) diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index 726501a2b1b..cfb2ccbe606 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -1,3 +1,9 @@ + + | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------------------------------------| | 3.4.0 | 20-07-2026 | Re-added EntraEligibleMembers table (Preview) now that backend ingestion is deployed to all regions |