From 3cb8aa56a39d879835dd21ff5e65dd7f8b271363 Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Wed, 28 Oct 2026 16:49:28 -0400 Subject: [PATCH 1/7] Draft Entra ID Assets Graph connector migration and parser Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../EntraAssetsLogs_ccf/DCR.json | 1127 ++++++++++ .../DataConnectorDefinition.json | 355 +++ .../EntraAssetsLogs_ccf/PollingConfig.json | 1949 +++++++++++++++++ .../table_EntraApplicationsV5.json | 112 + .../table_EntraDevicesV5.json | 187 ++ .../table_EntraEligibleMembersV5.json | 62 + .../table_EntraGroupMembershipsV5.json | 52 + .../table_EntraGroupsV5.json | 182 ++ .../table_EntraMembersV5.json | 62 + .../table_EntraOrgContactsV5.json | 117 + .../table_EntraOrganizationsV5.json | 132 ++ .../table_EntraOwnersV5.json | 62 + .../table_EntraServicePrincipalsV5.json | 137 ++ .../table_EntraSponsorsV5.json | 62 + .../table_EntraUsersV5.json | 302 +++ ...EntraIDAssets_DataConnectorDefinition.json | 4 +- .../Data/Solution_MicrosoftEntraAssets.json | 8 +- .../Parsers/EntraAssetsNormalize.yaml | 149 ++ Solutions/Microsoft Entra ID Assets/README.md | 125 ++ .../Microsoft Entra ID Assets/ReleaseNotes.md | 4 + 20 files changed, 5186 insertions(+), 4 deletions(-) create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json create mode 100644 Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml create mode 100644 Solutions/Microsoft Entra ID Assets/README.md diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json new file mode 100644 index 00000000000..3e12db8ff5e --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json @@ -0,0 +1,1127 @@ +{ + "name": "EntraCombinedV5TestDCR", + "apiVersion": "2023-03-11", + "type": "Microsoft.Insights/dataCollectionRules", + "location": "{{location}}", + "properties": { + "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", + "streamDeclarations": { + "Custom-EntraApplicationsV5_CL": { + "columns": [ + { + "name": "appId", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "groupMembershipClaims", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "identifierUris", + "type": "dynamic" + }, + { + "name": "isDeviceOnlyAuthSupported", + "type": "boolean" + }, + { + "name": "isFallbackPublicClient", + "type": "boolean" + }, + { + "name": "notes", + "type": "string" + }, + { + "name": "publisherDomain", + "type": "string" + }, + { + "name": "tags", + "type": "dynamic" + }, + { + "name": "uniqueName", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraDevicesV5_CL": { + "columns": [ + { + "name": "accountEnabled", + "type": "boolean" + }, + { + "name": "alternativeSecurityIds", + "type": "dynamic" + }, + { + "name": "approximateLastSignInDateTime", + "type": "datetime" + }, + { + "name": "deviceCategory", + "type": "string" + }, + { + "name": "deviceId", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "deviceMetadata", + "type": "string" + }, + { + "name": "deviceOwnership", + "type": "string" + }, + { + "name": "deviceVersion", + "type": "int" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "enrollmentProfileName", + "type": "string" + }, + { + "name": "enrollmentType", + "type": "string" + }, + { + "name": "isCompliant", + "type": "boolean" + }, + { + "name": "isManaged", + "type": "boolean" + }, + { + "name": "isRooted", + "type": "boolean" + }, + { + "name": "managementType", + "type": "string" + }, + { + "name": "manufacturer", + "type": "string" + }, + { + "name": "mdmAppId", + "type": "string" + }, + { + "name": "model", + "type": "string" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesSecurityIdentifier", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "operatingSystem", + "type": "string" + }, + { + "name": "operatingSystemVersion", + "type": "string" + }, + { + "name": "physicalIds", + "type": "dynamic" + }, + { + "name": "profileType", + "type": "string" + }, + { + "name": "registrationDateTime", + "type": "datetime" + }, + { + "name": "systemLabels", + "type": "dynamic" + }, + { + "name": "trustType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraGroupsV5_CL": { + "columns": [ + { + "name": "classification", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "expirationDateTime", + "type": "datetime" + }, + { + "name": "groupTypes", + "type": "dynamic" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "isAssignableToRole", + "type": "boolean" + }, + { + "name": "isManagementRestricted", + "type": "boolean" + }, + { + "name": "mail", + "type": "string" + }, + { + "name": "mailEnabled", + "type": "boolean" + }, + { + "name": "mailNickname", + "type": "string" + }, + { + "name": "membershipRule", + "type": "string" + }, + { + "name": "membershipRuleProcessingState", + "type": "string" + }, + { + "name": "onPremisesDomainName", + "type": "string" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesNetBiosName", + "type": "string" + }, + { + "name": "onPremisesSamAccountName", + "type": "string" + }, + { + "name": "onPremisesSecurityIdentifier", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "preferredDataLocation", + "type": "string" + }, + { + "name": "preferredLanguage", + "type": "string" + }, + { + "name": "proxyAddresses", + "type": "dynamic" + }, + { + "name": "renewedDateTime", + "type": "datetime" + }, + { + "name": "securityEnabled", + "type": "boolean" + }, + { + "name": "theme", + "type": "string" + }, + { + "name": "uniqueName", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraOrgContactsV5_CL": { + "columns": [ + { + "name": "addresses", + "type": "dynamic" + }, + { + "name": "companyName", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "givenName", + "type": "string" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "mail", + "type": "string" + }, + { + "name": "mailNickname", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesProvisioningErrors", + "type": "dynamic" + }, + { + "name": "proxyAddresses", + "type": "dynamic" + }, + { + "name": "surname", + "type": "string" + }, + { + "name": "phones", + "type": "dynamic" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraServicePrincipalsV5_CL": { + "columns": [ + { + "name": "accountEnabled", + "type": "boolean" + }, + { + "name": "alternativeNames", + "type": "dynamic" + }, + { + "name": "appId", + "type": "string" + }, + { + "name": "applicationTemplateId", + "type": "string" + }, + { + "name": "appOwnerOrganizationId", + "type": "string" + }, + { + "name": "appRoleAssignmentRequired", + "type": "boolean" + }, + { + "name": "description", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "homepage", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "loginUrl", + "type": "string" + }, + { + "name": "notes", + "type": "string" + }, + { + "name": "notificationEmailAddresses", + "type": "dynamic" + }, + { + "name": "preferredSingleSignOnMode", + "type": "string" + }, + { + "name": "preferredTokenSigningKeyThumbprint", + "type": "string" + }, + { + "name": "servicePrincipalNames", + "type": "dynamic" + }, + { + "name": "servicePrincipalType", + "type": "string" + }, + { + "name": "tags", + "type": "dynamic" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraUsersV5_CL": { + "columns": [ + { + "name": "accountEnabled", + "type": "boolean" + }, + { + "name": "ageGroup", + "type": "string" + }, + { + "name": "businessPhones", + "type": "dynamic" + }, + { + "name": "city", + "type": "string" + }, + { + "name": "companyName", + "type": "string" + }, + { + "name": "consentProvidedForMinor", + "type": "string" + }, + { + "name": "country", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "creationType", + "type": "string" + }, + { + "name": "department", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "employeeHireDate", + "type": "datetime" + }, + { + "name": "employeeId", + "type": "string" + }, + { + "name": "employeeLeaveDateTime", + "type": "datetime" + }, + { + "name": "employeeType", + "type": "string" + }, + { + "name": "externalUserState", + "type": "string" + }, + { + "name": "externalUserStateChangeDateTime", + "type": "datetime" + }, + { + "name": "faxNumber", + "type": "string" + }, + { + "name": "givenName", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "isManagementRestricted", + "type": "boolean" + }, + { + "name": "isResourceAccount", + "type": "boolean" + }, + { + "name": "jobTitle", + "type": "string" + }, + { + "name": "lastPasswordChangeDateTime", + "type": "datetime" + }, + { + "name": "legalAgeGroupClassification", + "type": "string" + }, + { + "name": "mail", + "type": "string" + }, + { + "name": "mailNickname", + "type": "string" + }, + { + "name": "mobilePhone", + "type": "string" + }, + { + "name": "officeLocation", + "type": "string" + }, + { + "name": "onPremisesDistinguishedName", + "type": "string" + }, + { + "name": "onPremisesDomainName", + "type": "string" + }, + { + "name": "onPremisesImmutableId", + "type": "string" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesSamAccountName", + "type": "string" + }, + { + "name": "onPremisesSecurityIdentifier", + "type": "string" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "onPremisesUserPrincipalName", + "type": "string" + }, + { + "name": "otherMails", + "type": "dynamic" + }, + { + "name": "passwordPolicies", + "type": "string" + }, + { + "name": "postalCode", + "type": "string" + }, + { + "name": "preferredDataLocation", + "type": "string" + }, + { + "name": "preferredLanguage", + "type": "string" + }, + { + "name": "proxyAddresses", + "type": "dynamic" + }, + { + "name": "showInAddressList", + "type": "boolean" + }, + { + "name": "signInSessionsValidFromDateTime", + "type": "datetime" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "streetAddress", + "type": "string" + }, + { + "name": "surname", + "type": "string" + }, + { + "name": "usageLocation", + "type": "string" + }, + { + "name": "userPrincipalName", + "type": "string" + }, + { + "name": "userType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "deletedDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraOrganizationsV5_CL": { + "columns": [ + { + "name": "businessPhones", + "type": "dynamic" + }, + { + "name": "city", + "type": "string" + }, + { + "name": "country", + "type": "string" + }, + { + "name": "countryLetterCode", + "type": "string" + }, + { + "name": "createdDateTime", + "type": "datetime" + }, + { + "name": "defaultUsageLocation", + "type": "string" + }, + { + "name": "displayName", + "type": "string" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "marketingNotificationEmails", + "type": "dynamic" + }, + { + "name": "onPremisesLastSyncDateTime", + "type": "datetime" + }, + { + "name": "onPremisesSyncEnabled", + "type": "boolean" + }, + { + "name": "partnerTenantType", + "type": "string" + }, + { + "name": "postalCode", + "type": "string" + }, + { + "name": "preferredLanguage", + "type": "string" + }, + { + "name": "securityComplianceNotificationMails", + "type": "dynamic" + }, + { + "name": "state", + "type": "string" + }, + { + "name": "street", + "type": "string" + }, + { + "name": "technicalNotificationMails", + "type": "dynamic" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "@removed", + "type": "dynamic" + } + ] + }, + "Custom-EntraGroupMembershipsV5_CL": { + "columns": [ + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraMembersV5_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraOwnersV5_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraSponsorsV5_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraEligibleMembersV5_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "feedType", + "type": "string" + }, + { + "name": "group", + "type": "dynamic" + }, + { + "name": "expand", + "type": "dynamic" + } + ] + }, + "Custom-EntraEligibleRoleMembersV5_CL": { + "columns": [ + { + "name": "sourceType", + "type": "string" + }, + { + "name": "roleDefinitionId", + "type": "string" + }, + { + "name": "principalId", + "type": "string" + }, + { + "name": "aadTenantId", + "type": "string" + }, + { + "name": "principal", + "type": "dynamic" + }, + { + "name": "id", + "type": "string" + }, + { + "name": "directoryScopeId", + "type": "string" + }, + { + "name": "appScopeId", + "type": "string" + }, + { + "name": "startDateTime", + "type": "datetime" + }, + { + "name": "endDateTime", + "type": "datetime" + }, + { + "name": "feedType", + "type": "string" + } + ] + } + }, + "destinations": { + "logAnalytics": [ + { + "workspaceResourceId": "{{workspaceResourceId}}", + "name": "clv2ws1" + } + ] + }, + "dataFlows": [ + { + "streams": [ + "Custom-EntraApplicationsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraApplicationsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , AppId = ['appId'] , CreatedDateTime = ['createdDateTime'] , Description = ['description'] , DisplayName = ['displayName'] , GroupMembershipClaims = ['groupMembershipClaims'] , Id = ['id'] , IdentifierUris = ['identifierUris'] , IsDeviceOnlyAuthSupported = ['isDeviceOnlyAuthSupported'] , IsFallbackPublicClient = ['isFallbackPublicClient'] , Notes = ['notes'] , PublisherDomain = ['publisherDomain'] , Tags = ['tags'] , UniqueName = ['uniqueName'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AppId , CreatedDateTime , Description , DisplayName , GroupMembershipClaims , Id , IdentifierUris , IsDeviceOnlyAuthSupported , IsFallbackPublicClient , Notes , PublisherDomain , Tags , UniqueName , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraDevicesV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraDevicesV5_CL", + "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AlternativeSecurityIds = ['alternativeSecurityIds'] , ApproximateLastSignInDateTime = ['approximateLastSignInDateTime'] , DeviceCategory = ['deviceCategory'] , DeviceId = ['deviceId'] , Id = ['id'] , DeviceMetadata = ['deviceMetadata'] , DeviceOwnership = ['deviceOwnership'] , DeviceVersion = ['deviceVersion'] , DisplayName = ['displayName'] , EnrollmentProfileName = ['enrollmentProfileName'] , EnrollmentType = ['enrollmentType'] , IsCompliant = ['isCompliant'] , IsManaged = ['isManaged'] , IsRooted = ['isRooted'] , ManagementType = ['managementType'] , Manufacturer = ['manufacturer'] , MdmAppId = ['mdmAppId'] , Model = ['model'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OperatingSystem = ['operatingSystem'] , OperatingSystemVersion = ['operatingSystemVersion'] , PhysicalIds = ['physicalIds'] , ProfileType = ['profileType'] , RegistrationDateTime = ['registrationDateTime'] , SystemLabels = ['systemLabels'] , TrustType = ['trustType'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AlternativeSecurityIds , ApproximateLastSignInDateTime , DeviceCategory , DeviceId , Id , DeviceMetadata , DeviceOwnership , DeviceVersion , DisplayName , EnrollmentProfileName , EnrollmentType , IsCompliant , IsManaged , IsRooted , ManagementType , Manufacturer , MdmAppId , Model , OnPremisesLastSyncDateTime , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , OperatingSystem , OperatingSystemVersion , PhysicalIds , ProfileType , RegistrationDateTime , SystemLabels , TrustType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraGroupsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraGroupsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , Classification = ['classification'] , CreatedDateTime = ['createdDateTime'] , Description = ['description'] , DisplayName = ['displayName'] , ExpirationDateTime = ['expirationDateTime'] , GroupTypes = ['groupTypes'] , Id = ['id'] , IsAssignableToRole = ['isAssignableToRole'] , IsManagementRestricted = ['isManagementRestricted'] , Mail = ['mail'] , MailEnabled = ['mailEnabled'] , MailNickname = ['mailNickname'] , MembershipRule = ['membershipRule'] , MembershipRuleProcessingState = ['membershipRuleProcessingState'] , OnPremisesDomainName = ['onPremisesDomainName'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesNetBiosName = ['onPremisesNetBiosName'] , OnPremisesSamAccountName = ['onPremisesSamAccountName'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , PreferredDataLocation = ['preferredDataLocation'] , PreferredLanguage = ['preferredLanguage'] , ProxyAddresses = ['proxyAddresses'] , RenewedDateTime = ['renewedDateTime'] , SecurityEnabled = ['securityEnabled'] , Theme = ['theme'] , UniqueName = ['uniqueName'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , Classification , CreatedDateTime , Description , DisplayName , ExpirationDateTime , GroupTypes , Id , IsAssignableToRole , IsManagementRestricted , Mail , MailEnabled , MailNickname , MembershipRule , MembershipRuleProcessingState , OnPremisesDomainName , OnPremisesLastSyncDateTime , OnPremisesNetBiosName , OnPremisesSamAccountName , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , PreferredDataLocation , PreferredLanguage , ProxyAddresses , RenewedDateTime , SecurityEnabled , Theme , UniqueName , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraOrgContactsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraOrgContactsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , Addresses = ['addresses'] , CompanyName = ['companyName'] , Department = ['department'] , DisplayName = ['displayName'] , GivenName = ['givenName'] , JobTitle = ['jobTitle'] , Mail = ['mail'] , MailNickname = ['mailNickname'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesProvisioningErrors = ['onPremisesProvisioningErrors'] , ProxyAddresses = ['proxyAddresses'] , Surname = ['surname'] , Phones = ['phones'] , Id = ['id'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , Addresses , CompanyName , Department , DisplayName , GivenName , JobTitle , Mail , MailNickname , OnPremisesSyncEnabled , OnPremisesLastSyncDateTime , OnPremisesProvisioningErrors , ProxyAddresses , Surname , Phones , Id , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraServicePrincipalsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraServicePrincipalsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AlternativeNames = ['alternativeNames'] , AppId = ['appId'] , ApplicationTemplateId = ['applicationTemplateId'] , AppOwnerOrganizationId = ['appOwnerOrganizationId'] , AppRoleAssignmentRequired = ['appRoleAssignmentRequired'] , Description = ['description'] , DisplayName = ['displayName'] , Homepage = ['homepage'] , Id = ['id'] , LoginUrl = ['loginUrl'] , Notes = ['notes'] , NotificationEmailAddresses = ['notificationEmailAddresses'] , PreferredSingleSignOnMode = ['preferredSingleSignOnMode'] , PreferredTokenSigningKeyThumbprint = ['preferredTokenSigningKeyThumbprint'] , ServicePrincipalNames = ['servicePrincipalNames'] , ServicePrincipalType = ['servicePrincipalType'] , Tags = ['tags'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AlternativeNames , AppId , ApplicationTemplateId , AppOwnerOrganizationId , AppRoleAssignmentRequired , Description , DisplayName , Homepage , Id , LoginUrl , Notes , NotificationEmailAddresses , PreferredSingleSignOnMode , PreferredTokenSigningKeyThumbprint , ServicePrincipalNames , ServicePrincipalType , Tags , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraUsersV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraUsersV5_CL", + "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AgeGroup = ['ageGroup'] , BusinessPhones = tostring(['businessPhones']) , City = ['city'] , CompanyName = ['companyName'] , ConsentProvidedForMinor = ['consentProvidedForMinor'] , Country = ['country'] , CreatedDateTime = ['createdDateTime'] , CreationType = ['creationType'] , Department = ['department'] , DisplayName = ['displayName'] , EmployeeHireDate = ['employeeHireDate'] , EmployeeId = ['employeeId'] , EmployeeLeaveDateTime = ['employeeLeaveDateTime'] , EmployeeType = ['employeeType'] , ExternalUserState = ['externalUserState'] , ExternalUserStateChangeDateTime = ['externalUserStateChangeDateTime'] , FaxNumber = ['faxNumber'] , GivenName = ['givenName'] , Id = ['id'] , IsManagementRestricted = ['isManagementRestricted'] , IsResourceAccount = ['isResourceAccount'] , JobTitle = ['jobTitle'] , LastPasswordChangeDateTime = ['lastPasswordChangeDateTime'] , LegalAgeGroupClassification = ['legalAgeGroupClassification'] , Mail = ['mail'] , MailNickname = ['mailNickname'] , MobilePhone = ['mobilePhone'] , OfficeLocation = ['officeLocation'] , OnPremisesDistinguishedName = ['onPremisesDistinguishedName'] , OnPremisesDomainName = ['onPremisesDomainName'] , OnPremisesImmutableId = ['onPremisesImmutableId'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSamAccountName = ['onPremisesSamAccountName'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OnPremisesUserPrincipalName = ['onPremisesUserPrincipalName'] , OtherMails = ['otherMails'] , PasswordPolicies = ['passwordPolicies'] , PostalCode = ['postalCode'] , PreferredDataLocation = ['preferredDataLocation'] , PreferredLanguage = ['preferredLanguage'] , ProxyAddresses = ['proxyAddresses'] , ShowInAddressList = ['showInAddressList'] , SignInSessionsValidFromDateTime = ['signInSessionsValidFromDateTime'] , State = ['state'] , StreetAddress = ['streetAddress'] , Surname = ['surname'] , UsageLocation = ['usageLocation'] , UserPrincipalName = ['userPrincipalName'] , UserType = ['userType'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AgeGroup , BusinessPhones , City , CompanyName , ConsentProvidedForMinor , Country , CreatedDateTime , CreationType , Department , DisplayName , EmployeeHireDate , EmployeeId , EmployeeLeaveDateTime , EmployeeType , ExternalUserState , ExternalUserStateChangeDateTime , FaxNumber , GivenName , Id , IsManagementRestricted , IsResourceAccount , JobTitle , LastPasswordChangeDateTime , LegalAgeGroupClassification , Mail , MailNickname , MobilePhone , OfficeLocation , OnPremisesDistinguishedName , OnPremisesDomainName , OnPremisesImmutableId , OnPremisesLastSyncDateTime , OnPremisesSamAccountName , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , OnPremisesUserPrincipalName , OtherMails , PasswordPolicies , PostalCode , PreferredDataLocation , PreferredLanguage , ProxyAddresses , ShowInAddressList , SignInSessionsValidFromDateTime , State , StreetAddress , Surname , UsageLocation , UserPrincipalName , UserType , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraOrganizationsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraOrganizationsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , BusinessPhones = tostring(['businessPhones']) , City = ['city'] , Country = ['country'] , CountryLetterCode = ['countryLetterCode'] , CreatedDateTime = ['createdDateTime'] , DefaultUsageLocation = ['defaultUsageLocation'] , DisplayName = ['displayName'] , Id = ['id'] , MarketingNotificationEmails = ['marketingNotificationEmails'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , PartnerTenantType = ['partnerTenantType'] , PostalCode = ['postalCode'] , PreferredLanguage = ['preferredLanguage'] , SecurityComplianceNotificationMails = ['securityComplianceNotificationMails'] , State = ['state'] , Street = ['street'] , TechnicalNotificationMails = ['technicalNotificationMails'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , BusinessPhones , City , Country , CountryLetterCode , CreatedDateTime , DefaultUsageLocation , DisplayName , Id , MarketingNotificationEmails , OnPremisesLastSyncDateTime , OnPremisesSyncEnabled , PartnerTenantType , PostalCode , PreferredLanguage , SecurityComplianceNotificationMails , State , Street , TechnicalNotificationMails , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraGroupMembershipsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraGroupMembershipsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , AADTenantId = ['aadTenantId'] , SourceId = tostring(group.id) , TargetId = tostring(expand.id) , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , AADTenantId , SourceId , TargetId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraMembersV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraMembersV5_CL", + "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = tostring(group.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , TargetId = tostring(expand.id) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraOwnersV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraOwnersV5_CL", + "transformKql": "source | extend TimeGenerated = now() , SourceId = tostring(group.id) , SourceType = ['sourceType'] , TargetId = tostring(expand.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceId , SourceType , TargetId , TargetType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraSponsorsV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraSponsorsV5_CL", + "transformKql": "source | extend TimeGenerated = now() , SourceId = tostring(group.id) , SourceType = ['sourceType'] , TargetId = tostring(expand.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceId , SourceType , TargetId , TargetType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraEligibleMembersV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraEligibleMembersV5_CL", + "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = tostring(expand.groupId) , TargetType = iff(tostring(expand.principal['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand.principal['@odata.type']), 17), tostring(expand.principal['@odata.type'])) , TargetId = tostring(expand.principalId) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) and tostring(expand.accessId) == 'member' and (isempty(tostring(expand.startDateTime)) or todatetime(expand.startDateTime) <= now()) and (isempty(tostring(expand.endDateTime)) or todatetime(expand.endDateTime) > now()) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + }, + { + "streams": [ + "Custom-EntraEligibleRoleMembersV5_CL" + ], + "destinations": [ + "clv2ws1" + ], + "outputStream": "Custom-EntraEligibleMembersV5_CL", + "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = ['roleDefinitionId'] , TargetType = iff(tostring(principal['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(principal['@odata.type']), 17), tostring(principal['@odata.type'])) , TargetId = ['principalId'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where (isnull(startDateTime) or startDateTime <= now()) and (isnull(endDateTime) or endDateTime > now()) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" + } + ] + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json new file mode 100644 index 00000000000..6d2e41d2392 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -0,0 +1,355 @@ +{ + "name": "EntraCombinedV5Test", + "apiVersion": "2025-09-01", + "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", + "location": "{{location}}", + "kind": "Customizable", + "properties": { + "connectorUiConfig": { + "id": "EntraCombinedV5Test", + "title": "Entra ID Assets (via MS Graph)", + "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/AADCloudSync.svg", + "publisher": "Microsoft", + "descriptionMarkdown": "Microsoft Entra assets include users, groups, applications, service principals and devices, together with their membership and ownership relationships. Collect this inventory in Microsoft Sentinel with weekly snapshots and hourly changefeeds where supported.", + "graphQueries": [ + { + "metricName": "EntraApplicationsV5_CL observations", + "legend": "EntraApplicationsV5_CL", + "baseQuery": "EntraApplicationsV5_CL" + }, + { + "metricName": "EntraDevicesV5_CL observations", + "legend": "EntraDevicesV5_CL", + "baseQuery": "EntraDevicesV5_CL" + }, + { + "metricName": "EntraGroupsV5_CL observations", + "legend": "EntraGroupsV5_CL", + "baseQuery": "EntraGroupsV5_CL" + }, + { + "metricName": "EntraOrgContactsV5_CL observations", + "legend": "EntraOrgContactsV5_CL", + "baseQuery": "EntraOrgContactsV5_CL" + }, + { + "metricName": "EntraServicePrincipalsV5_CL observations", + "legend": "EntraServicePrincipalsV5_CL", + "baseQuery": "EntraServicePrincipalsV5_CL" + }, + { + "metricName": "EntraUsersV5_CL observations", + "legend": "EntraUsersV5_CL", + "baseQuery": "EntraUsersV5_CL" + }, + { + "metricName": "EntraOrganizationsV5_CL observations", + "legend": "EntraOrganizationsV5_CL", + "baseQuery": "EntraOrganizationsV5_CL" + }, + { + "metricName": "EntraGroupMembershipsV5_CL observations", + "legend": "EntraGroupMembershipsV5_CL", + "baseQuery": "EntraGroupMembershipsV5_CL" + }, + { + "metricName": "EntraMembersV5_CL observations", + "legend": "EntraMembersV5_CL", + "baseQuery": "EntraMembersV5_CL" + }, + { + "metricName": "EntraOwnersV5_CL observations", + "legend": "EntraOwnersV5_CL", + "baseQuery": "EntraOwnersV5_CL" + }, + { + "metricName": "EntraSponsorsV5_CL observations", + "legend": "EntraSponsorsV5_CL", + "baseQuery": "EntraSponsorsV5_CL" + }, + { + "metricName": "EntraEligibleMembersV5_CL observations", + "legend": "EntraEligibleMembersV5_CL", + "baseQuery": "EntraEligibleMembersV5_CL" + } + ], + "sampleQueries": [ + { + "description": "Recent EntraApplicationsV5_CL", + "query": "EntraApplicationsV5_CL | take 100" + }, + { + "description": "EntraApplicationsV5_CL freshness", + "query": "EntraApplicationsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraDevicesV5_CL", + "query": "EntraDevicesV5_CL | take 100" + }, + { + "description": "EntraDevicesV5_CL freshness", + "query": "EntraDevicesV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraGroupsV5_CL", + "query": "EntraGroupsV5_CL | take 100" + }, + { + "description": "EntraGroupsV5_CL freshness", + "query": "EntraGroupsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraOrgContactsV5_CL", + "query": "EntraOrgContactsV5_CL | take 100" + }, + { + "description": "EntraOrgContactsV5_CL freshness", + "query": "EntraOrgContactsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraServicePrincipalsV5_CL", + "query": "EntraServicePrincipalsV5_CL | take 100" + }, + { + "description": "EntraServicePrincipalsV5_CL freshness", + "query": "EntraServicePrincipalsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraUsersV5_CL", + "query": "EntraUsersV5_CL | take 100" + }, + { + "description": "EntraUsersV5_CL freshness", + "query": "EntraUsersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraOrganizationsV5_CL", + "query": "EntraOrganizationsV5_CL | take 100" + }, + { + "description": "EntraOrganizationsV5_CL freshness", + "query": "EntraOrganizationsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraGroupMembershipsV5_CL", + "query": "EntraGroupMembershipsV5_CL | take 100" + }, + { + "description": "EntraGroupMembershipsV5_CL freshness", + "query": "EntraGroupMembershipsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraMembersV5_CL", + "query": "EntraMembersV5_CL | take 100" + }, + { + "description": "EntraMembersV5_CL freshness", + "query": "EntraMembersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraOwnersV5_CL", + "query": "EntraOwnersV5_CL | take 100" + }, + { + "description": "EntraOwnersV5_CL freshness", + "query": "EntraOwnersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraSponsorsV5_CL", + "query": "EntraSponsorsV5_CL | take 100" + }, + { + "description": "EntraSponsorsV5_CL freshness", + "query": "EntraSponsorsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + }, + { + "description": "Recent EntraEligibleMembersV5_CL", + "query": "EntraEligibleMembersV5_CL | take 100" + }, + { + "description": "EntraEligibleMembersV5_CL freshness", + "query": "EntraEligibleMembersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + } + ], + "dataTypes": [ + { + "name": "EntraApplicationsV5_CL", + "lastDataReceivedQuery": "EntraApplicationsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraDevicesV5_CL", + "lastDataReceivedQuery": "EntraDevicesV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraGroupsV5_CL", + "lastDataReceivedQuery": "EntraGroupsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraOrgContactsV5_CL", + "lastDataReceivedQuery": "EntraOrgContactsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraServicePrincipalsV5_CL", + "lastDataReceivedQuery": "EntraServicePrincipalsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraUsersV5_CL", + "lastDataReceivedQuery": "EntraUsersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraOrganizationsV5_CL", + "lastDataReceivedQuery": "EntraOrganizationsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraGroupMembershipsV5_CL", + "lastDataReceivedQuery": "EntraGroupMembershipsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraMembersV5_CL", + "lastDataReceivedQuery": "EntraMembersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraOwnersV5_CL", + "lastDataReceivedQuery": "EntraOwnersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraSponsorsV5_CL", + "lastDataReceivedQuery": "EntraSponsorsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + }, + { + "name": "EntraEligibleMembersV5_CL", + "lastDataReceivedQuery": "EntraEligibleMembersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + } + ], + "connectivityCriteria": [ + { + "type": "HasDataConnectors" + } + ], + "availability": { + "isPreview": true, + "status": 1 + }, + "permissions": { + "resourceProvider": [ + { + "provider": "Microsoft.OperationalInsights/workspaces", + "permissionsDisplayText": "Read and Write permissions are required.", + "providerDisplayName": "Workspace", + "scope": "Workspace", + "requiredPermissions": { + "write": true, + "read": true, + "delete": true, + "action": false + } + } + ] + }, + "instructionSteps": [ + { + "title": "Connections", + "description": "Collect all asset and relationship paths together.", + "instructions": [ + { + "type": "DataConnectorsGrid", + "parameters": { + "mapping": [ + { + "columnName": "Connection", + "columnValue": "properties.addOnAttributes.friendlyName" + }, + { + "columnName": "Tenant", + "columnValue": "properties.addOnAttributes.aadTenantId" + }, + { + "columnName": "Source type", + "columnValue": "properties.addOnAttributes.sourceType" + }, + { + "columnName": "Stream", + "columnValue": "properties.dataType" + } + ], + "menuItems": [ + "DeleteConnector" + ], + "isMultiSelect": true + } + }, + { + "type": "ContextPane", + "parameters": { + "label": "Add connection", + "title": "Connect Entra assets and relationships", + "subtitle": "Weekly snapshots and hourly deltas", + "contextPaneType": "DataConnectorsContextPane", + "instructionSteps": [ + { + "instructions": [ + { + "type": "Markdown", + "parameters": { + "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** Includes a Graph beta endpoint; unsupported for production applications.\n\n**Weekly snapshot-only tables:** EntraOrganizationsV5_CL, EntraMembersV5_CL, EntraOwnersV5_CL, EntraGroupMembershipsV5_CL, EntraSponsorsV5_CL and EntraEligibleMembersV5_CL have no changefeed configured and receive only weekly snapshots, not hourly updates.\n\n**Warning:** Sponsors, GroupMemberships and EligibleMembers snapshots may take up to 5 days in large tenants, or longer with throttling. This is an estimate, not a guaranteed maximum or SLA; early rows do not indicate completion.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required. If eligibility fails, other collectors may still be connected; verify their deployment status." + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Connection name", + "placeholder": "Unique name", + "type": "text", + "name": "friendlyName", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Tenant ID", + "placeholder": "Tenant GUID", + "type": "text", + "name": "tenantId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Application client ID", + "placeholder": "Application GUID", + "type": "text", + "name": "clientId", + "validations": { + "required": true + } + } + }, + { + "type": "Textbox", + "parameters": { + "label": "Client secret", + "placeholder": "Secret value", + "type": "password", + "name": "clientSecret", + "validations": { + "required": true + } + } + } + ] + } + ] + } + } + ] + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json new file mode 100644 index 00000000000..b194147a15a --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json @@ -0,0 +1,1949 @@ +[ + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupMemberships' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups/$parentId$/transitiveMembers/microsoft.graph.user", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json", + "ConsistencyLevel": "eventual" + }, + "queryParameters": { + "$select": "id", + "$top": "999", + "$count": "true" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParaName": "$top", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraGroupMembershipsV5", + "dcrConfig": { + "streamName": "Custom-EntraGroupMembershipsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/beta/groups/$parentId$/members", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraMembersV5", + "dcrConfig": { + "streamName": "Custom-EntraMembersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestRoleMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/directoryRoles", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/directoryRoles", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/directoryRoles/$parentId$/members", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraMembersV5", + "dcrConfig": { + "streamName": "Custom-EntraMembersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "role", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups/$parentId$/owners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOwnersV5", + "dcrConfig": { + "streamName": "Custom-EntraOwnersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestApplicationOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications/$parentId$/owners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOwnersV5", + "dcrConfig": { + "streamName": "Custom-EntraOwnersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "application", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestServicePrincipalOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals/$parentId$/owners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOwnersV5", + "dcrConfig": { + "streamName": "Custom-EntraOwnersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "servicePrincipal", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestDeviceOwners' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices/$parentId$/registeredOwners", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOwnersV5", + "dcrConfig": { + "streamName": "Custom-EntraOwnersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "device", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestUserSponsors' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users/$parentId$/sponsors", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraSponsorsV5", + "dcrConfig": { + "streamName": "Custom-EntraSponsorsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "user", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestEligibleGroupMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "shouldJoinNestedData": true, + "joinedDataStepName": "group", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "stepInfo": { + "stepType": "Nested", + "nextSteps": [ + { + "stepId": "fetchRelationships", + "stepPlaceholdersParsingKql": "source | project res = parse_json(data) | project parentId = tostring(res.id)" + } + ] + }, + "stepCollectorConfigs": { + "fetchRelationships": { + "shouldJoinNestedData": true, + "joinedDataStepName": "expand", + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/identityGovernance/privilegedAccess/group/eligibilityScheduleInstances", + "httpMethod": "GET", + "rateLimitQPS": 10, + "maxParallelism": 10, + "paginatedCallsPerSecond": 5.0, + "queryWindowInMin": 5, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$filter": "principalId eq '$parentId$'", + "$expand": "principal($select=id)" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + } + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraEligibleMembersV5", + "dcrConfig": { + "streamName": "Custom-EntraEligibleMembersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "extra": { + "nestedTransformName": "/ASI/Microsoft/MvExpandTransformer" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "group", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestEligibleRoleMembers' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleInstances", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 180, + "headers": { + "Accept": "application/json" + }, + "queryParameters": { + "$select": "id,roleDefinitionId,principalId,directoryScopeId,appScopeId,startDateTime,endDateTime", + "$expand": "principal($select=id)" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleInstances", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": {} + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraEligibleMembersV5", + "dcrConfig": { + "streamName": "Custom-EntraEligibleRoleMembersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "sourceType": "roleDefinition", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestApplicationsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "appId,createdDateTime,description,displayName,groupMembershipClaims,id,identifierUris,isDeviceOnlyAuthSupported,isFallbackPublicClient,notes,publisherDomain,tags,uniqueName,deletedDateTime", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraApplicationsV5", + "dcrConfig": { + "streamName": "Custom-EntraApplicationsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestApplicationsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "appId,createdDateTime,description,displayName,groupMembershipClaims,id,identifierUris,isDeviceOnlyAuthSupported,isFallbackPublicClient,notes,publisherDomain,tags,uniqueName,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/applications", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraApplicationsV5", + "dcrConfig": { + "streamName": "Custom-EntraApplicationsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestDevicesSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeSecurityIds,approximateLastSignInDateTime,deviceCategory,deviceId,id,deviceMetadata,deviceOwnership,deviceVersion,displayName,enrollmentProfileName,enrollmentType,isCompliant,isManaged,isRooted,managementType,manufacturer,mdmAppId,model,onPremisesLastSyncDateTime,onPremisesSecurityIdentifier,onPremisesSyncEnabled,operatingSystem,operatingSystemVersion,physicalIds,profileType,registrationDateTime,systemLabels,trustType", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraDevicesV5", + "dcrConfig": { + "streamName": "Custom-EntraDevicesV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestDevicesChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeSecurityIds,approximateLastSignInDateTime,deviceCategory,deviceId,id,deviceMetadata,deviceOwnership,deviceVersion,displayName,enrollmentProfileName,enrollmentType,isCompliant,isManaged,isRooted,managementType,manufacturer,mdmAppId,model,onPremisesLastSyncDateTime,onPremisesSecurityIdentifier,onPremisesSyncEnabled,operatingSystem,operatingSystemVersion,physicalIds,profileType,registrationDateTime,systemLabels,trustType", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/devices", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraDevicesV5", + "dcrConfig": { + "streamName": "Custom-EntraDevicesV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "classification,createdDateTime,description,displayName,expirationDateTime,groupTypes,id,isAssignableToRole,isManagementRestricted,mail,mailEnabled,mailNickname,membershipRule,membershipRuleProcessingState,onPremisesDomainName,onPremisesLastSyncDateTime,onPremisesNetBiosName,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,preferredDataLocation,preferredLanguage,proxyAddresses,renewedDateTime,securityEnabled,theme,uniqueName,deletedDateTime", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraGroupsV5", + "dcrConfig": { + "streamName": "Custom-EntraGroupsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "classification,createdDateTime,description,displayName,expirationDateTime,groupTypes,id,isAssignableToRole,isManagementRestricted,mail,mailEnabled,mailNickname,membershipRule,membershipRuleProcessingState,onPremisesDomainName,onPremisesLastSyncDateTime,onPremisesNetBiosName,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,preferredDataLocation,preferredLanguage,proxyAddresses,renewedDateTime,securityEnabled,theme,uniqueName,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/groups", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraGroupsV5", + "dcrConfig": { + "streamName": "Custom-EntraGroupsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestOrgContactsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "addresses,companyName,department,displayName,givenName,jobTitle,mail,mailNickname,onPremisesSyncEnabled,onPremisesLastSyncDateTime,onPremisesProvisioningErrors,proxyAddresses,surname,phones,id", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOrgContactsV5", + "dcrConfig": { + "streamName": "Custom-EntraOrgContactsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestOrgContactsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "addresses,companyName,department,displayName,givenName,jobTitle,mail,mailNickname,onPremisesSyncEnabled,onPremisesLastSyncDateTime,onPremisesProvisioningErrors,proxyAddresses,surname,phones,id", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/contacts", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOrgContactsV5", + "dcrConfig": { + "streamName": "Custom-EntraOrgContactsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestServicePrincipalsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeNames,appId,applicationTemplateId,appOwnerOrganizationId,appRoleAssignmentRequired,description,displayName,homepage,id,loginUrl,notes,notificationEmailAddresses,preferredSingleSignOnMode,preferredTokenSigningKeyThumbprint,servicePrincipalNames,servicePrincipalType,tags,deletedDateTime", + "$top": "100" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 100, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraServicePrincipalsV5", + "dcrConfig": { + "streamName": "Custom-EntraServicePrincipalsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestServicePrincipalsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,alternativeNames,appId,applicationTemplateId,appOwnerOrganizationId,appRoleAssignmentRequired,description,displayName,homepage,id,loginUrl,notes,notificationEmailAddresses,preferredSingleSignOnMode,preferredTokenSigningKeyThumbprint,servicePrincipalNames,servicePrincipalType,tags,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/servicePrincipals", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraServicePrincipalsV5", + "dcrConfig": { + "streamName": "Custom-EntraServicePrincipalsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestUsersSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,ageGroup,businessPhones,city,companyName,consentProvidedForMinor,country,createdDateTime,creationType,department,displayName,employeeHireDate,employeeId,employeeLeaveDateTime,employeeType,externalUserState,externalUserStateChangeDateTime,faxNumber,givenName,id,isManagementRestricted,isResourceAccount,jobTitle,lastPasswordChangeDateTime,legalAgeGroupClassification,mail,mailNickname,mobilePhone,officeLocation,onPremisesDistinguishedName,onPremisesDomainName,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,onPremisesUserPrincipalName,otherMails,passwordPolicies,postalCode,preferredDataLocation,preferredLanguage,proxyAddresses,showInAddressList,signInSessionsValidFromDateTime,state,streetAddress,surname,usageLocation,userPrincipalName,userType,deletedDateTime", + "$top": "999" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "LinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink']", + "pageSize": 999, + "pageSizeParameterName": "$top", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id", + "$top": "1" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraUsersV5", + "dcrConfig": { + "streamName": "Custom-EntraUsersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestUsersChangefeed' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users/delta", + "httpMethod": "GET", + "rateLimitQPS": 1, + "paginatedCallsPerSecond": 1.0, + "queryWindowInMin": 60, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "accountEnabled,ageGroup,businessPhones,city,companyName,consentProvidedForMinor,country,createdDateTime,creationType,department,displayName,employeeHireDate,employeeId,employeeLeaveDateTime,employeeType,externalUserState,externalUserStateChangeDateTime,faxNumber,givenName,id,isManagementRestricted,isResourceAccount,jobTitle,lastPasswordChangeDateTime,legalAgeGroupClassification,mail,mailNickname,mobilePhone,officeLocation,onPremisesDistinguishedName,onPremisesDomainName,onPremisesImmutableId,onPremisesLastSyncDateTime,onPremisesSamAccountName,onPremisesSecurityIdentifier,onPremisesSyncEnabled,onPremisesUserPrincipalName,otherMails,passwordPolicies,postalCode,preferredDataLocation,preferredLanguage,proxyAddresses,showInAddressList,signInSessionsValidFromDateTime,state,streetAddress,surname,usageLocation,userPrincipalName,userType,deletedDateTime", + "$deltatoken": "latest" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "paging": { + "pagingType": "PersistentLinkHeader", + "linkHeaderTokenJsonPath": "$.['@odata.nextLink', '@odata.deltaLink']", + "pagingQueryParamOnly": true + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/users", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraUsersV5", + "dcrConfig": { + "streamName": "Custom-EntraUsersV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Changefeed" + } + } + }, + { + "type": "Microsoft.SecurityInsights/dataConnectors", + "apiVersion": "2025-09-01", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestOrganizationsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "location": "{{location}}", + "kind": "RestApiPoller", + "properties": { + "auth": { + "type": "OAuth2", + "ClientId": "[[parameters('clientId')]", + "ClientSecret": "[[parameters('clientSecret')]", + "GrantType": "client_credentials", + "TokenEndpoint": "[[concat('https://login.microsoftonline.com/', parameters('tenantId'), '/oauth2/v2.0/token')]", + "Scope": "https://graph.microsoft.com/.default" + }, + "request": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/organization", + "httpMethod": "GET", + "rateLimitQPS": 1, + "queryWindowInMin": 10080, + "retryCount": 6, + "timeoutInSeconds": 300, + "headers": { + "Accept": "application/json", + "User-Agent": "Microsoft-Sentinel-EntraAssets" + }, + "queryParameters": { + "$select": "businessPhones,city,country,countryLetterCode,createdDateTime,defaultUsageLocation,displayName,id,marketingNotificationEmails,onPremisesLastSyncDateTime,onPremisesSyncEnabled,partnerTenantType,postalCode,preferredLanguage,securityComplianceNotificationMails,state,street,technicalNotificationMails" + } + }, + "response": { + "eventsJsonPaths": [ + "$.value" + ], + "format": "json" + }, + "checkConnectivityRequest": { + "apiEndpoint": "https://graph.microsoft.com/v1.0/organization", + "httpMethod": "GET", + "retryCount": 3, + "timeoutInSeconds": 30, + "queryParameters": { + "$select": "id" + } + }, + "connectorDefinitionName": "EntraCombinedV5Test", + "dataType": "EntraOrganizationsV5", + "dcrConfig": { + "streamName": "Custom-EntraOrganizationsV5_CL", + "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", + "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" + }, + "addOnAttributes": { + "aadTenantId": "[[parameters('tenantId')]", + "friendlyName": "[[parameters('friendlyName')]", + "feedType": "Snapshot" + } + } + } +] \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json new file mode 100644 index 00000000000..af36699a9c9 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json @@ -0,0 +1,112 @@ +{ + "name": "EntraApplicationsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraApplicationsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraApplicationsV5_CL", + "description": "EntraApplicationsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "AppId", + "type": "string", + "description": "App id" + }, + { + "name": "CreatedDateTime", + "type": "datetime", + "description": "Created date time" + }, + { + "name": "Description", + "type": "string", + "description": "Description" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "GroupMembershipClaims", + "type": "string", + "description": "Group membership claims" + }, + { + "name": "Id", + "type": "string", + "description": "Id" + }, + { + "name": "IdentifierUris", + "type": "dynamic", + "description": "Identifier uris" + }, + { + "name": "IsDeviceOnlyAuthSupported", + "type": "boolean", + "description": "Is device only auth supported" + }, + { + "name": "IsFallbackPublicClient", + "type": "boolean", + "description": "Is fallback public client" + }, + { + "name": "Notes", + "type": "string", + "description": "Notes" + }, + { + "name": "PublisherDomain", + "type": "string", + "description": "Publisher domain" + }, + { + "name": "Tags", + "type": "dynamic", + "description": "Tags" + }, + { + "name": "UniqueName", + "type": "string", + "description": "Unique name" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "DeletedDateTime", + "type": "datetime", + "description": "Deleted date time" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json new file mode 100644 index 00000000000..d3c86691efd --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json @@ -0,0 +1,187 @@ +{ + "name": "EntraDevicesV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraDevicesV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraDevicesV5_CL", + "description": "EntraDevicesV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "AccountEnabled", + "type": "boolean", + "description": "Account enabled" + }, + { + "name": "AlternativeSecurityIds", + "type": "dynamic", + "description": "Alternative security ids" + }, + { + "name": "ApproximateLastSignInDateTime", + "type": "datetime", + "description": "Approximate last sign in date time" + }, + { + "name": "DeviceCategory", + "type": "string", + "description": "Device category" + }, + { + "name": "DeviceId", + "type": "string", + "description": "Device registration ID, distinct from the directory-object Id." + }, + { + "name": "Id", + "type": "string", + "description": "Directory-object ID used by Microsoft Graph delta updates and deletions." + }, + { + "name": "DeviceMetadata", + "type": "string", + "description": "Device metadata" + }, + { + "name": "DeviceOwnership", + "type": "string", + "description": "Device ownership" + }, + { + "name": "DeviceVersion", + "type": "int", + "description": "Device version" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "EnrollmentProfileName", + "type": "string", + "description": "Enrollment profile name" + }, + { + "name": "EnrollmentType", + "type": "string", + "description": "Enrollment type" + }, + { + "name": "IsCompliant", + "type": "boolean", + "description": "Is compliant" + }, + { + "name": "IsManaged", + "type": "boolean", + "description": "Is managed" + }, + { + "name": "IsRooted", + "type": "boolean", + "description": "Is rooted" + }, + { + "name": "ManagementType", + "type": "string", + "description": "Management type" + }, + { + "name": "Manufacturer", + "type": "string", + "description": "Manufacturer" + }, + { + "name": "MdmAppId", + "type": "string", + "description": "Mdm app id" + }, + { + "name": "Model", + "type": "string", + "description": "Model" + }, + { + "name": "OnPremisesLastSyncDateTime", + "type": "datetime", + "description": "On premises last sync date time" + }, + { + "name": "OnPremisesSecurityIdentifier", + "type": "string", + "description": "On premises security identifier" + }, + { + "name": "OnPremisesSyncEnabled", + "type": "boolean", + "description": "On premises sync enabled" + }, + { + "name": "OperatingSystem", + "type": "string", + "description": "Operating system" + }, + { + "name": "OperatingSystemVersion", + "type": "string", + "description": "Operating system version" + }, + { + "name": "PhysicalIds", + "type": "dynamic", + "description": "Physical ids" + }, + { + "name": "ProfileType", + "type": "string", + "description": "Profile type" + }, + { + "name": "RegistrationDateTime", + "type": "datetime", + "description": "Registration date time" + }, + { + "name": "SystemLabels", + "type": "dynamic", + "description": "System labels" + }, + { + "name": "TrustType", + "type": "string", + "description": "Trust type" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json new file mode 100644 index 00000000000..fce361a06e8 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json @@ -0,0 +1,62 @@ +{ + "name": "EntraEligibleMembersV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraEligibleMembersV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraEligibleMembersV5_CL", + "description": "EntraEligibleMembersV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "SourceType", + "type": "string", + "description": "Source type" + }, + { + "name": "SourceId", + "type": "string", + "description": "Source id" + }, + { + "name": "TargetType", + "type": "string", + "description": "Target type" + }, + { + "name": "TargetId", + "type": "string", + "description": "Target id" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json new file mode 100644 index 00000000000..b506425a6fd --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json @@ -0,0 +1,52 @@ +{ + "name": "EntraGroupMembershipsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraGroupMembershipsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraGroupMembershipsV5_CL", + "description": "EntraGroupMembershipsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "SourceId", + "type": "string", + "description": "Source id" + }, + { + "name": "TargetId", + "type": "string", + "description": "Target id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json new file mode 100644 index 00000000000..eebd290a973 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json @@ -0,0 +1,182 @@ +{ + "name": "EntraGroupsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraGroupsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraGroupsV5_CL", + "description": "EntraGroupsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "Classification", + "type": "string", + "description": "Classification" + }, + { + "name": "CreatedDateTime", + "type": "datetime", + "description": "Created date time" + }, + { + "name": "Description", + "type": "string", + "description": "Description" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "ExpirationDateTime", + "type": "datetime", + "description": "Expiration date time" + }, + { + "name": "GroupTypes", + "type": "dynamic", + "description": "Group types" + }, + { + "name": "Id", + "type": "string", + "description": "Id" + }, + { + "name": "IsAssignableToRole", + "type": "boolean", + "description": "Is assignable to role" + }, + { + "name": "IsManagementRestricted", + "type": "boolean", + "description": "Is management restricted" + }, + { + "name": "Mail", + "type": "string", + "description": "Mail" + }, + { + "name": "MailEnabled", + "type": "boolean", + "description": "Mail enabled" + }, + { + "name": "MailNickname", + "type": "string", + "description": "Mail nickname" + }, + { + "name": "MembershipRule", + "type": "string", + "description": "Membership rule" + }, + { + "name": "MembershipRuleProcessingState", + "type": "string", + "description": "Membership rule processing state" + }, + { + "name": "OnPremisesDomainName", + "type": "string", + "description": "On premises domain name" + }, + { + "name": "OnPremisesLastSyncDateTime", + "type": "datetime", + "description": "On premises last sync date time" + }, + { + "name": "OnPremisesNetBiosName", + "type": "string", + "description": "On premises net bios name" + }, + { + "name": "OnPremisesSamAccountName", + "type": "string", + "description": "On premises sam account name" + }, + { + "name": "OnPremisesSecurityIdentifier", + "type": "string", + "description": "On premises security identifier" + }, + { + "name": "OnPremisesSyncEnabled", + "type": "boolean", + "description": "On premises sync enabled" + }, + { + "name": "PreferredDataLocation", + "type": "string", + "description": "Preferred data location" + }, + { + "name": "PreferredLanguage", + "type": "string", + "description": "Preferred language" + }, + { + "name": "ProxyAddresses", + "type": "dynamic", + "description": "Proxy addresses" + }, + { + "name": "RenewedDateTime", + "type": "datetime", + "description": "Renewed date time" + }, + { + "name": "SecurityEnabled", + "type": "boolean", + "description": "Security enabled" + }, + { + "name": "Theme", + "type": "string", + "description": "Theme" + }, + { + "name": "UniqueName", + "type": "string", + "description": "Unique name" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "DeletedDateTime", + "type": "datetime", + "description": "Deleted date time" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json new file mode 100644 index 00000000000..4ca564ebeae --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json @@ -0,0 +1,62 @@ +{ + "name": "EntraMembersV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraMembersV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraMembersV5_CL", + "description": "EntraMembersV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "SourceType", + "type": "string", + "description": "Source type" + }, + { + "name": "SourceId", + "type": "string", + "description": "Source id" + }, + { + "name": "TargetType", + "type": "string", + "description": "Target type" + }, + { + "name": "TargetId", + "type": "string", + "description": "Target id" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json new file mode 100644 index 00000000000..f95a9b04441 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json @@ -0,0 +1,117 @@ +{ + "name": "EntraOrgContactsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraOrgContactsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraOrgContactsV5_CL", + "description": "EntraOrgContactsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "Addresses", + "type": "dynamic", + "description": "Addresses" + }, + { + "name": "CompanyName", + "type": "string", + "description": "Company name" + }, + { + "name": "Department", + "type": "string", + "description": "Department" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "GivenName", + "type": "string", + "description": "Given name" + }, + { + "name": "JobTitle", + "type": "string", + "description": "Job title" + }, + { + "name": "Mail", + "type": "string", + "description": "Mail" + }, + { + "name": "MailNickname", + "type": "string", + "description": "Mail nickname" + }, + { + "name": "OnPremisesSyncEnabled", + "type": "boolean", + "description": "On premises sync enabled" + }, + { + "name": "OnPremisesLastSyncDateTime", + "type": "datetime", + "description": "On premises last sync date time" + }, + { + "name": "OnPremisesProvisioningErrors", + "type": "dynamic", + "description": "On premises provisioning errors" + }, + { + "name": "ProxyAddresses", + "type": "dynamic", + "description": "Proxy addresses" + }, + { + "name": "Surname", + "type": "string", + "description": "Surname" + }, + { + "name": "Phones", + "type": "dynamic", + "description": "Phones" + }, + { + "name": "Id", + "type": "string", + "description": "Id" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json new file mode 100644 index 00000000000..155bd4986f9 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json @@ -0,0 +1,132 @@ +{ + "name": "EntraOrganizationsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraOrganizationsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraOrganizationsV5_CL", + "description": "EntraOrganizationsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "BusinessPhones", + "type": "string", + "description": "Business phones" + }, + { + "name": "City", + "type": "string", + "description": "City" + }, + { + "name": "Country", + "type": "string", + "description": "Country" + }, + { + "name": "CountryLetterCode", + "type": "string", + "description": "Country letter code" + }, + { + "name": "CreatedDateTime", + "type": "datetime", + "description": "Created date time" + }, + { + "name": "DefaultUsageLocation", + "type": "string", + "description": "Default usage location" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "Id", + "type": "string", + "description": "Id" + }, + { + "name": "MarketingNotificationEmails", + "type": "dynamic", + "description": "Marketing notification emails" + }, + { + "name": "OnPremisesLastSyncDateTime", + "type": "datetime", + "description": "On premises last sync date time" + }, + { + "name": "OnPremisesSyncEnabled", + "type": "boolean", + "description": "On premises sync enabled" + }, + { + "name": "PartnerTenantType", + "type": "string", + "description": "Partner tenant type" + }, + { + "name": "PostalCode", + "type": "string", + "description": "Postal code" + }, + { + "name": "PreferredLanguage", + "type": "string", + "description": "Preferred language" + }, + { + "name": "SecurityComplianceNotificationMails", + "type": "dynamic", + "description": "Security compliance notification mails" + }, + { + "name": "State", + "type": "string", + "description": "State" + }, + { + "name": "Street", + "type": "string", + "description": "Street" + }, + { + "name": "TechnicalNotificationMails", + "type": "dynamic", + "description": "Technical notification mails" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json new file mode 100644 index 00000000000..89faa953efb --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json @@ -0,0 +1,62 @@ +{ + "name": "EntraOwnersV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraOwnersV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraOwnersV5_CL", + "description": "EntraOwnersV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "SourceId", + "type": "string", + "description": "Source id" + }, + { + "name": "SourceType", + "type": "string", + "description": "Source type" + }, + { + "name": "TargetId", + "type": "string", + "description": "Target id" + }, + { + "name": "TargetType", + "type": "string", + "description": "Target type" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json new file mode 100644 index 00000000000..b172c74e214 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json @@ -0,0 +1,137 @@ +{ + "name": "EntraServicePrincipalsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraServicePrincipalsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraServicePrincipalsV5_CL", + "description": "EntraServicePrincipalsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "AccountEnabled", + "type": "boolean", + "description": "Account enabled" + }, + { + "name": "AlternativeNames", + "type": "dynamic", + "description": "Alternative names" + }, + { + "name": "AppId", + "type": "string", + "description": "App id" + }, + { + "name": "ApplicationTemplateId", + "type": "string", + "description": "Application template id" + }, + { + "name": "AppOwnerOrganizationId", + "type": "string", + "description": "App owner organization id" + }, + { + "name": "AppRoleAssignmentRequired", + "type": "boolean", + "description": "App role assignment required" + }, + { + "name": "Description", + "type": "string", + "description": "Description" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "Homepage", + "type": "string", + "description": "Homepage" + }, + { + "name": "Id", + "type": "string", + "description": "Id" + }, + { + "name": "LoginUrl", + "type": "string", + "description": "Login url" + }, + { + "name": "Notes", + "type": "string", + "description": "Notes" + }, + { + "name": "NotificationEmailAddresses", + "type": "dynamic", + "description": "Notification email addresses" + }, + { + "name": "PreferredSingleSignOnMode", + "type": "string", + "description": "Preferred single sign on mode" + }, + { + "name": "PreferredTokenSigningKeyThumbprint", + "type": "string", + "description": "Preferred token signing key thumbprint" + }, + { + "name": "ServicePrincipalNames", + "type": "dynamic", + "description": "Service principal names" + }, + { + "name": "ServicePrincipalType", + "type": "string", + "description": "Service principal type" + }, + { + "name": "Tags", + "type": "dynamic", + "description": "Tags" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "DeletedDateTime", + "type": "datetime", + "description": "Deleted date time" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json new file mode 100644 index 00000000000..f05f556a861 --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json @@ -0,0 +1,62 @@ +{ + "name": "EntraSponsorsV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraSponsorsV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraSponsorsV5_CL", + "description": "EntraSponsorsV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "SourceId", + "type": "string", + "description": "Source id" + }, + { + "name": "SourceType", + "type": "string", + "description": "Source type" + }, + { + "name": "TargetId", + "type": "string", + "description": "Target id" + }, + { + "name": "TargetType", + "type": "string", + "description": "Target type" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json new file mode 100644 index 00000000000..c7afa1a2f9f --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json @@ -0,0 +1,302 @@ +{ + "name": "EntraUsersV5_CL", + "type": "Microsoft.OperationalInsights/workspaces/tables", + "apiVersion": "2023-09-01", + "tags": { + "StreamName": "Custom-EntraUsersV5_CL", + "DataSource": "EntraCombinedV5Test" + }, + "properties": { + "schema": { + "name": "EntraUsersV5_CL", + "description": "EntraUsersV5_CL Microsoft Graph relationship observations", + "columns": [ + { + "name": "AccountEnabled", + "type": "boolean", + "description": "Account enabled" + }, + { + "name": "AgeGroup", + "type": "string", + "description": "Age group" + }, + { + "name": "BusinessPhones", + "type": "string", + "description": "Business phones" + }, + { + "name": "City", + "type": "string", + "description": "City" + }, + { + "name": "CompanyName", + "type": "string", + "description": "Company name" + }, + { + "name": "ConsentProvidedForMinor", + "type": "string", + "description": "Consent provided for minor" + }, + { + "name": "Country", + "type": "string", + "description": "Country" + }, + { + "name": "CreatedDateTime", + "type": "datetime", + "description": "Created date time" + }, + { + "name": "CreationType", + "type": "string", + "description": "Creation type" + }, + { + "name": "Department", + "type": "string", + "description": "Department" + }, + { + "name": "DisplayName", + "type": "string", + "description": "Display name" + }, + { + "name": "EmployeeHireDate", + "type": "datetime", + "description": "Employee hire date" + }, + { + "name": "EmployeeId", + "type": "string", + "description": "Employee id" + }, + { + "name": "EmployeeLeaveDateTime", + "type": "datetime", + "description": "Employee leave date time" + }, + { + "name": "EmployeeType", + "type": "string", + "description": "Employee type" + }, + { + "name": "ExternalUserState", + "type": "string", + "description": "External user state" + }, + { + "name": "ExternalUserStateChangeDateTime", + "type": "datetime", + "description": "External user state change date time" + }, + { + "name": "FaxNumber", + "type": "string", + "description": "Fax number" + }, + { + "name": "GivenName", + "type": "string", + "description": "Given name" + }, + { + "name": "Id", + "type": "string", + "description": "Id" + }, + { + "name": "IsManagementRestricted", + "type": "boolean", + "description": "Is management restricted" + }, + { + "name": "IsResourceAccount", + "type": "boolean", + "description": "Is resource account" + }, + { + "name": "JobTitle", + "type": "string", + "description": "Job title" + }, + { + "name": "LastPasswordChangeDateTime", + "type": "datetime", + "description": "Last password change date time" + }, + { + "name": "LegalAgeGroupClassification", + "type": "string", + "description": "Legal age group classification" + }, + { + "name": "Mail", + "type": "string", + "description": "Mail" + }, + { + "name": "MailNickname", + "type": "string", + "description": "Mail nickname" + }, + { + "name": "MobilePhone", + "type": "string", + "description": "Mobile phone" + }, + { + "name": "OfficeLocation", + "type": "string", + "description": "Office location" + }, + { + "name": "OnPremisesDistinguishedName", + "type": "string", + "description": "On premises distinguished name" + }, + { + "name": "OnPremisesDomainName", + "type": "string", + "description": "On premises domain name" + }, + { + "name": "OnPremisesImmutableId", + "type": "string", + "description": "On premises immutable id" + }, + { + "name": "OnPremisesLastSyncDateTime", + "type": "datetime", + "description": "On premises last sync date time" + }, + { + "name": "OnPremisesSamAccountName", + "type": "string", + "description": "On premises sam account name" + }, + { + "name": "OnPremisesSecurityIdentifier", + "type": "string", + "description": "On premises security identifier" + }, + { + "name": "OnPremisesSyncEnabled", + "type": "boolean", + "description": "On premises sync enabled" + }, + { + "name": "OnPremisesUserPrincipalName", + "type": "string", + "description": "On premises user principal name" + }, + { + "name": "OtherMails", + "type": "dynamic", + "description": "Other mails" + }, + { + "name": "PasswordPolicies", + "type": "string", + "description": "Password policies" + }, + { + "name": "PostalCode", + "type": "string", + "description": "Postal code" + }, + { + "name": "PreferredDataLocation", + "type": "string", + "description": "Preferred data location" + }, + { + "name": "PreferredLanguage", + "type": "string", + "description": "Preferred language" + }, + { + "name": "ProxyAddresses", + "type": "dynamic", + "description": "Proxy addresses" + }, + { + "name": "ShowInAddressList", + "type": "boolean", + "description": "Show in address list" + }, + { + "name": "SignInSessionsValidFromDateTime", + "type": "datetime", + "description": "Sign in sessions valid from date time" + }, + { + "name": "State", + "type": "string", + "description": "State" + }, + { + "name": "StreetAddress", + "type": "string", + "description": "Street address" + }, + { + "name": "Surname", + "type": "string", + "description": "Surname" + }, + { + "name": "UsageLocation", + "type": "string", + "description": "Usage location" + }, + { + "name": "UserPrincipalName", + "type": "string", + "description": "User principal name" + }, + { + "name": "UserType", + "type": "string", + "description": "User type" + }, + { + "name": "AADTenantId", + "type": "string", + "description": "Aad tenant id" + }, + { + "name": "DeletedDateTime", + "type": "datetime", + "description": "Deleted date time" + }, + { + "name": "TimeGenerated", + "type": "datetime", + "description": "Time generated" + }, + { + "name": "FeedType", + "type": "string", + "description": "Feed type" + }, + { + "name": "FeedTypeVersion", + "type": "string", + "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." + }, + { + "name": "IsAssetRemoved", + "type": "boolean", + "description": "Is asset removed" + } + ] + } + } +} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json index 29ea37f505a..b0336623ee6 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json @@ -1,9 +1,9 @@ { "id": "EntraIDAssets", - "title": "Microsoft Entra ID Assets", + "title": "[Deprecated] Microsoft Entra ID Assets", "publisher": "Microsoft", "logo": "AADCloudSync.svg", - "descriptionMarkdown": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", + "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Entra ID Assets (via MS Graph)**, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", "graphQueries": [], "sampleQueries": [], "dataTypes": [], diff --git a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json index 11bc241a0e7..f23c6447af9 100644 --- a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json +++ b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json @@ -2,9 +2,13 @@ "Name": "Microsoft Entra ID Assets", "Author": "Microsoft", "Logo": "", - "Description": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", + "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. The preview Entra ID Assets (via MS Graph) connector ingests inventory into a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes one schema-normalization parser for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).", "Data Connectors": [ - "Data Connectors/EntraIDAssets_DataConnectorDefinition.json" + "Data Connectors/EntraIDAssets_DataConnectorDefinition.json", + "Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json" + ], + "Parsers": [ + "Parsers/EntraAssetsNormalize.yaml" ], "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Entra ID Assets", "Version": "3.4.0", diff --git a/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml new file mode 100644 index 00000000000..736d57e8cac --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml @@ -0,0 +1,149 @@ +Function: + Title: Microsoft Entra ID Assets - Schema Normalization + Version: '1.0.0' + LastUpdated: '2026-10-28' +Product: Microsoft Entra ID +Description: | + Normalizes legacy camelCase and current PascalCase Entra asset and relationship data + to a shared PascalCase schema at query time without modifying stored data. + Existing PascalCase columns take precedence by column presence, including null and + empty values. Fields absent from the source remain empty or null. + Legacy data must already be queryable in the environment where the function runs. + This does not migrate data or reconstruct snapshot or changefeed state. +FunctionName: EntraAssetsNormalize +FunctionAlias: EntraAssetsNormalize +Function Title: Microsoft Entra ID Assets - Schema Normalization +FunctionParams: + - Name: T + Type: '(*)' +Category: Microsoft Sentinel Parser +id: acfde93c-7e63-4877-870a-2d11e2806f37 +FunctionQuery: | + T + | project + AppId = tostring(column_ifexists('AppId', column_ifexists('appId', ''))), + CreatedDateTime = todatetime(column_ifexists('CreatedDateTime', column_ifexists('createdDateTime', datetime(null)))), + Description = tostring(column_ifexists('Description', column_ifexists('description', ''))), + DisplayName = tostring(column_ifexists('DisplayName', column_ifexists('displayName', ''))), + GroupMembershipClaims = tostring(column_ifexists('GroupMembershipClaims', column_ifexists('groupMembershipClaims', ''))), + Id = tostring(column_ifexists('Id', column_ifexists('id', ''))), + IdentifierUris = todynamic(column_ifexists('IdentifierUris', column_ifexists('identifierUris', dynamic(null)))), + IsDeviceOnlyAuthSupported = tobool(column_ifexists('IsDeviceOnlyAuthSupported', column_ifexists('isDeviceOnlyAuthSupported', bool(null)))), + IsFallbackPublicClient = tobool(column_ifexists('IsFallbackPublicClient', column_ifexists('isFallbackPublicClient', bool(null)))), + Notes = tostring(column_ifexists('Notes', column_ifexists('notes', ''))), + PublisherDomain = tostring(column_ifexists('PublisherDomain', column_ifexists('publisherDomain', ''))), + Tags = todynamic(column_ifexists('Tags', column_ifexists('tags', dynamic(null)))), + UniqueName = tostring(column_ifexists('UniqueName', column_ifexists('uniqueName', ''))), + AADTenantId = tostring(column_ifexists('AADTenantId', column_ifexists('aadTenantId', column_ifexists('tenantId', '')))), + DeletedDateTime = todatetime(column_ifexists('DeletedDateTime', column_ifexists('deletedDateTime', datetime(null)))), + TimeGenerated = todatetime(column_ifexists('TimeGenerated', column_ifexists('timeGenerated', datetime(null)))), + FeedType = tostring(column_ifexists('FeedType', column_ifexists('feedType', ''))), + FeedTypeVersion = tostring(column_ifexists('FeedTypeVersion', column_ifexists('feedTypeVersion', ''))), + IsAssetRemoved = tobool(column_ifexists('IsAssetRemoved', column_ifexists('isAssetRemoved', bool(null)))), + AccountEnabled = tobool(column_ifexists('AccountEnabled', column_ifexists('accountEnabled', bool(null)))), + AlternativeSecurityIds = todynamic(column_ifexists('AlternativeSecurityIds', column_ifexists('alternativeSecurityIds', dynamic(null)))), + ApproximateLastSignInDateTime = todatetime(column_ifexists('ApproximateLastSignInDateTime', column_ifexists('approximateLastSignInDateTime', datetime(null)))), + DeviceCategory = tostring(column_ifexists('DeviceCategory', column_ifexists('deviceCategory', ''))), + DeviceId = tostring(column_ifexists('DeviceId', column_ifexists('deviceId', ''))), + DeviceMetadata = tostring(column_ifexists('DeviceMetadata', column_ifexists('deviceMetadata', ''))), + DeviceOwnership = tostring(column_ifexists('DeviceOwnership', column_ifexists('deviceOwnership', ''))), + DeviceVersion = toint(column_ifexists('DeviceVersion', column_ifexists('deviceVersion', int(null)))), + EnrollmentProfileName = tostring(column_ifexists('EnrollmentProfileName', column_ifexists('enrollmentProfileName', ''))), + EnrollmentType = tostring(column_ifexists('EnrollmentType', column_ifexists('enrollmentType', ''))), + IsCompliant = tobool(column_ifexists('IsCompliant', column_ifexists('isCompliant', bool(null)))), + IsManaged = tobool(column_ifexists('IsManaged', column_ifexists('isManaged', bool(null)))), + IsRooted = tobool(column_ifexists('IsRooted', column_ifexists('isRooted', bool(null)))), + ManagementType = tostring(column_ifexists('ManagementType', column_ifexists('managementType', ''))), + Manufacturer = tostring(column_ifexists('Manufacturer', column_ifexists('manufacturer', ''))), + MdmAppId = tostring(column_ifexists('MdmAppId', column_ifexists('mdmAppId', ''))), + Model = tostring(column_ifexists('Model', column_ifexists('model', ''))), + OnPremisesLastSyncDateTime = todatetime(column_ifexists('OnPremisesLastSyncDateTime', column_ifexists('onPremisesLastSyncDateTime', datetime(null)))), + OnPremisesSecurityIdentifier = tostring(column_ifexists('OnPremisesSecurityIdentifier', column_ifexists('onPremisesSecurityIdentifier', ''))), + OnPremisesSyncEnabled = tobool(column_ifexists('OnPremisesSyncEnabled', column_ifexists('onPremisesSyncEnabled', bool(null)))), + OperatingSystem = tostring(column_ifexists('OperatingSystem', column_ifexists('operatingSystem', ''))), + OperatingSystemVersion = tostring(column_ifexists('OperatingSystemVersion', column_ifexists('operatingSystemVersion', ''))), + PhysicalIds = todynamic(column_ifexists('PhysicalIds', column_ifexists('physicalIds', dynamic(null)))), + ProfileType = tostring(column_ifexists('ProfileType', column_ifexists('profileType', ''))), + RegistrationDateTime = todatetime(column_ifexists('RegistrationDateTime', column_ifexists('registrationDateTime', datetime(null)))), + SystemLabels = todynamic(column_ifexists('SystemLabels', column_ifexists('systemLabels', dynamic(null)))), + TrustType = tostring(column_ifexists('TrustType', column_ifexists('trustType', ''))), + Classification = tostring(column_ifexists('Classification', column_ifexists('classification', ''))), + ExpirationDateTime = todatetime(column_ifexists('ExpirationDateTime', column_ifexists('expirationDateTime', datetime(null)))), + GroupTypes = todynamic(column_ifexists('GroupTypes', column_ifexists('groupTypes', dynamic(null)))), + IsAssignableToRole = tobool(column_ifexists('IsAssignableToRole', column_ifexists('isAssignableToRole', bool(null)))), + IsManagementRestricted = tobool(column_ifexists('IsManagementRestricted', column_ifexists('isManagementRestricted', bool(null)))), + Mail = tostring(column_ifexists('Mail', column_ifexists('mail', ''))), + MailEnabled = tobool(column_ifexists('MailEnabled', column_ifexists('mailEnabled', bool(null)))), + MailNickname = tostring(column_ifexists('MailNickname', column_ifexists('mailNickname', ''))), + MembershipRule = tostring(column_ifexists('MembershipRule', column_ifexists('membershipRule', ''))), + MembershipRuleProcessingState = tostring(column_ifexists('MembershipRuleProcessingState', column_ifexists('membershipRuleProcessingState', ''))), + OnPremisesDomainName = tostring(column_ifexists('OnPremisesDomainName', column_ifexists('onPremisesDomainName', ''))), + OnPremisesNetBiosName = tostring(column_ifexists('OnPremisesNetBiosName', column_ifexists('onPremisesNetBiosName', ''))), + OnPremisesSamAccountName = tostring(column_ifexists('OnPremisesSamAccountName', column_ifexists('onPremisesSamAccountName', ''))), + PreferredDataLocation = tostring(column_ifexists('PreferredDataLocation', column_ifexists('preferredDataLocation', ''))), + PreferredLanguage = tostring(column_ifexists('PreferredLanguage', column_ifexists('preferredLanguage', ''))), + ProxyAddresses = todynamic(column_ifexists('ProxyAddresses', column_ifexists('proxyAddresses', dynamic(null)))), + RenewedDateTime = todatetime(column_ifexists('RenewedDateTime', column_ifexists('renewedDateTime', datetime(null)))), + SecurityEnabled = tobool(column_ifexists('SecurityEnabled', column_ifexists('securityEnabled', bool(null)))), + Theme = tostring(column_ifexists('Theme', column_ifexists('theme', ''))), + Addresses = todynamic(column_ifexists('Addresses', column_ifexists('addresses', dynamic(null)))), + CompanyName = tostring(column_ifexists('CompanyName', column_ifexists('companyName', ''))), + Department = tostring(column_ifexists('Department', column_ifexists('department', ''))), + GivenName = tostring(column_ifexists('GivenName', column_ifexists('givenName', ''))), + JobTitle = tostring(column_ifexists('JobTitle', column_ifexists('jobTitle', ''))), + OnPremisesProvisioningErrors = todynamic(column_ifexists('OnPremisesProvisioningErrors', column_ifexists('onPremisesProvisioningErrors', dynamic(null)))), + Surname = tostring(column_ifexists('Surname', column_ifexists('surname', ''))), + Phones = todynamic(column_ifexists('Phones', column_ifexists('phones', dynamic(null)))), + AlternativeNames = todynamic(column_ifexists('AlternativeNames', column_ifexists('alternativeNames', dynamic(null)))), + ApplicationTemplateId = tostring(column_ifexists('ApplicationTemplateId', column_ifexists('applicationTemplateId', ''))), + AppOwnerOrganizationId = tostring(column_ifexists('AppOwnerOrganizationId', column_ifexists('appOwnerOrganizationId', ''))), + AppRoleAssignmentRequired = tobool(column_ifexists('AppRoleAssignmentRequired', column_ifexists('appRoleAssignmentRequired', bool(null)))), + Homepage = tostring(column_ifexists('Homepage', column_ifexists('homepage', ''))), + LoginUrl = tostring(column_ifexists('LoginUrl', column_ifexists('loginUrl', ''))), + NotificationEmailAddresses = todynamic(column_ifexists('NotificationEmailAddresses', column_ifexists('notificationEmailAddresses', dynamic(null)))), + PreferredSingleSignOnMode = tostring(column_ifexists('PreferredSingleSignOnMode', column_ifexists('preferredSingleSignOnMode', ''))), + PreferredTokenSigningKeyThumbprint = tostring(column_ifexists('PreferredTokenSigningKeyThumbprint', column_ifexists('preferredTokenSigningKeyThumbprint', ''))), + ServicePrincipalNames = todynamic(column_ifexists('ServicePrincipalNames', column_ifexists('servicePrincipalNames', dynamic(null)))), + ServicePrincipalType = tostring(column_ifexists('ServicePrincipalType', column_ifexists('servicePrincipalType', ''))), + AgeGroup = tostring(column_ifexists('AgeGroup', column_ifexists('ageGroup', ''))), + BusinessPhones = tostring(column_ifexists('BusinessPhones', column_ifexists('businessPhones', ''))), + City = tostring(column_ifexists('City', column_ifexists('city', ''))), + ConsentProvidedForMinor = tostring(column_ifexists('ConsentProvidedForMinor', column_ifexists('consentProvidedForMinor', ''))), + Country = tostring(column_ifexists('Country', column_ifexists('country', ''))), + CreationType = tostring(column_ifexists('CreationType', column_ifexists('creationType', ''))), + EmployeeHireDate = todatetime(column_ifexists('EmployeeHireDate', column_ifexists('employeeHireDate', datetime(null)))), + EmployeeId = tostring(column_ifexists('EmployeeId', column_ifexists('employeeId', ''))), + EmployeeLeaveDateTime = todatetime(column_ifexists('EmployeeLeaveDateTime', column_ifexists('employeeLeaveDateTime', datetime(null)))), + EmployeeType = tostring(column_ifexists('EmployeeType', column_ifexists('employeeType', ''))), + ExternalUserState = tostring(column_ifexists('ExternalUserState', column_ifexists('externalUserState', ''))), + ExternalUserStateChangeDateTime = todatetime(column_ifexists('ExternalUserStateChangeDateTime', column_ifexists('externalUserStateChangeDateTime', datetime(null)))), + FaxNumber = tostring(column_ifexists('FaxNumber', column_ifexists('faxNumber', ''))), + IsResourceAccount = tobool(column_ifexists('IsResourceAccount', column_ifexists('isResourceAccount', bool(null)))), + LastPasswordChangeDateTime = todatetime(column_ifexists('LastPasswordChangeDateTime', column_ifexists('lastPasswordChangeDateTime', datetime(null)))), + LegalAgeGroupClassification = tostring(column_ifexists('LegalAgeGroupClassification', column_ifexists('legalAgeGroupClassification', ''))), + MobilePhone = tostring(column_ifexists('MobilePhone', column_ifexists('mobilePhone', ''))), + OfficeLocation = tostring(column_ifexists('OfficeLocation', column_ifexists('officeLocation', ''))), + OnPremisesDistinguishedName = tostring(column_ifexists('OnPremisesDistinguishedName', column_ifexists('onPremisesDistinguishedName', ''))), + OnPremisesImmutableId = tostring(column_ifexists('OnPremisesImmutableId', column_ifexists('onPremisesImmutableId', ''))), + OnPremisesUserPrincipalName = tostring(column_ifexists('OnPremisesUserPrincipalName', column_ifexists('onPremisesUserPrincipalName', ''))), + OtherMails = todynamic(column_ifexists('OtherMails', column_ifexists('otherMails', dynamic(null)))), + PasswordPolicies = tostring(column_ifexists('PasswordPolicies', column_ifexists('passwordPolicies', ''))), + PostalCode = tostring(column_ifexists('PostalCode', column_ifexists('postalCode', ''))), + ShowInAddressList = tobool(column_ifexists('ShowInAddressList', column_ifexists('showInAddressList', bool(null)))), + SignInSessionsValidFromDateTime = todatetime(column_ifexists('SignInSessionsValidFromDateTime', column_ifexists('signInSessionsValidFromDateTime', datetime(null)))), + State = tostring(column_ifexists('State', column_ifexists('state', ''))), + StreetAddress = tostring(column_ifexists('StreetAddress', column_ifexists('streetAddress', ''))), + UsageLocation = tostring(column_ifexists('UsageLocation', column_ifexists('usageLocation', ''))), + UserPrincipalName = tostring(column_ifexists('UserPrincipalName', column_ifexists('userPrincipalName', ''))), + UserType = tostring(column_ifexists('UserType', column_ifexists('userType', ''))), + CountryLetterCode = tostring(column_ifexists('CountryLetterCode', column_ifexists('countryLetterCode', ''))), + DefaultUsageLocation = tostring(column_ifexists('DefaultUsageLocation', column_ifexists('defaultUsageLocation', ''))), + MarketingNotificationEmails = todynamic(column_ifexists('MarketingNotificationEmails', column_ifexists('marketingNotificationEmails', dynamic(null)))), + PartnerTenantType = tostring(column_ifexists('PartnerTenantType', column_ifexists('partnerTenantType', ''))), + SecurityComplianceNotificationMails = todynamic(column_ifexists('SecurityComplianceNotificationMails', column_ifexists('securityComplianceNotificationMails', dynamic(null)))), + Street = tostring(column_ifexists('Street', column_ifexists('street', ''))), + TechnicalNotificationMails = todynamic(column_ifexists('TechnicalNotificationMails', column_ifexists('technicalNotificationMails', dynamic(null)))), + SourceId = tostring(column_ifexists('SourceId', column_ifexists('sourceId', ''))), + TargetId = tostring(column_ifexists('TargetId', column_ifexists('targetId', ''))), + SourceType = tostring(column_ifexists('SourceType', column_ifexists('sourceType', ''))), + TargetType = tostring(column_ifexists('TargetType', column_ifexists('targetType', ''))) diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md new file mode 100644 index 00000000000..2441a810e1d --- /dev/null +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -0,0 +1,125 @@ +# Microsoft Entra ID Assets + +This solution contains the legacy data-lake connector, the preview **Entra ID Assets +(via MS Graph)** connector for Azure Log Analytics, and one shared schema-normalization +parser. Deprecation applies to the legacy connector, not to the solution. + +> **Draft preview:** The new connector retains isolated `EntraCombinedV5Test` resource +> identities and `V5_CL` custom tables for validation. These are not onboarded Microsoft +> standard tables. Production naming, release readiness, and coordinated publication +> of the replacement and deprecation notice require maintainer review. No retirement +> date or automatic cutover is established by this draft. + +## Set up the Graph connector + +1. Install the solution in a Microsoft Sentinel-enabled Log Analytics workspace and + open **Entra ID Assets (via MS Graph)**. +2. In the workspace's deployment tenant, register a single-tenant Microsoft Entra app. + No redirect URI is required. Copy its Application (client) ID, not its Object ID. +3. Add Microsoft Graph **application** permissions and grant administrator consent: + `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, + `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, + `Organization.Read.All`, `RoleManagement.Read.Directory`, + `RoleEligibilitySchedule.Read.Directory`, and + `PrivilegedEligibilitySchedule.Read.AzureADGroup`. + Add `Member.Read.Hidden` when collecting hidden memberships. +4. Create a client secret and copy its **Value**, not its Secret ID. Store it securely + and rotate it before expiration. Provide a unique connection name, tenant ID, + application client ID, and secret through the connector's **Add connection** pane. +5. Check every collector's deployment status and table freshness. Eligibility requires + Microsoft Entra ID P2 or Microsoft Entra ID Governance. A failed eligibility + collector does not establish that the other collectors failed or succeeded. + +The connector supports multiple named connections. It uses 23 pollers: 17 weekly +snapshot paths and six hourly asset changefeeds. + +| Dataset | Custom table | Collection | +| --- | --- | --- | +| Applications | `EntraApplicationsV5_CL` | Weekly snapshot; hourly changes | +| Devices | `EntraDevicesV5_CL` | Weekly snapshot; hourly changes | +| Groups | `EntraGroupsV5_CL` | Weekly snapshot; hourly changes | +| Organizational contacts | `EntraOrgContactsV5_CL` | Weekly snapshot; hourly changes | +| Service principals | `EntraServicePrincipalsV5_CL` | Weekly snapshot; hourly changes | +| Users | `EntraUsersV5_CL` | Weekly snapshot; hourly changes | +| Organizations | `EntraOrganizationsV5_CL` | Weekly snapshot | +| Transitive group user memberships | `EntraGroupMembershipsV5_CL` | Weekly snapshot | +| Direct members | `EntraMembersV5_CL` | Weekly snapshot | +| Owners | `EntraOwnersV5_CL` | Weekly snapshot | +| Sponsors | `EntraSponsorsV5_CL` | Weekly snapshot | +| Eligible members | `EntraEligibleMembersV5_CL` | Weekly snapshot | + +### Collection limitations + +- Hourly changefeeds start with `$deltatoken=latest`, not an initial full enumeration. + Continuation and delta links are persisted. Snapshots provide the separate baseline; + consumers must reconcile changes, deletion tombstones, and at-least-once delivery. +- `FeedTypeVersion` is a string containing the Sunday UTC calendar-week bucket for + snapshot rows; it is empty for changefeed rows. It is not a unique crawl ID or a + completion watermark. Same-week runs share a bucket and a run crossing the week + boundary can span two buckets. +- Nested collection is preview. Group parent paging uses Graph's default page size; + transitive user membership children use `$top=999` and eventual consistency. + Prior paging checks do not establish complete collection at production scale. +- Direct group-member collection uses Microsoft Graph **beta** to include service + principals. Beta APIs are not supported for production applications. +- Sponsors, transitive memberships, and eligibility snapshots can take days in large + tenants. The connector's five-day estimate is not a maximum or SLA. Early rows do + not establish snapshot completion. +- Complete V5 ingestion and live parser execution have not been established by this + draft. Validate in a nonproduction workspace before planning a production cutover. + +## Schema normalization + +**Microsoft Entra ID Assets - Schema Normalization** installs the single function +`EntraAssetsNormalize(T:(*))`. It accepts a queryable asset or relationship table and +converts legacy camelCase fields to the PascalCase names and types used by the new +connector. It also accepts existing PascalCase input. + +```kusto +EntraUsersV5_CL +| invoke EntraAssetsNormalize() +| project Id, DisplayName, AADTenantId, AccountEnabled +``` + +The output is a shared 126-column schema; project the dataset-specific fields needed +by your query. Nonapplicable fields remain empty or null. PascalCase columns take +precedence by **column presence**, including explicit nulls, false, zero, and empty +values. Source tenant mapping accepts `AADTenantId`, `aadTenantId`, or `tenantId`, +never the Log Analytics workspace `TenantId`. Device `Id` is not inferred from +`DeviceId`. Extra legacy fields are not retained, and missing feed metadata is not +invented. + +This is query-time adaptation, not physical migration, data transport, automatic +query rewriting, or snapshot/changefeed reconstruction. Installing a Log Analytics +function does not establish its availability in the data-lake query engine. To +validate against existing lake system tables, first confirm supported function +syntax and data access in that environment; the query body can be tried as an inline +tabular function. Lake execution remains unverified. + +## Migrate from the legacy connector + +1. Inventory existing queries and downstream dependencies, especially Purview data + risk graphs. The new Log Analytics connector is **not established as an equivalent + backend for those graphs**. Do not disconnect their source without owner confirmation. +2. Configure the replacement in a nonproduction workspace. Review permissions, + licensing, preview/beta limitations, and Log Analytics ingestion and retention costs. +3. Verify every required dataset, paging, identity and field mappings, baseline + completeness, delta reconciliation, and freshness. Review affected queries for the + new table names, PascalCase fields, and changed collection semantics. +4. Where needed, use the normalization parser for accessible legacy data. It does not + move historical data into Log Analytics or make unchanged legacy queries compatible. +5. Only after validation and dependency approval, explicitly disconnect the legacy + collector using its existing controls. A Content Hub update or deprecation label + does not stop existing collection or migrate connections and historical data. + +Keep the legacy connector available for existing installations during review. This +draft does not remove its resource identity, instructions, connectivity checks, or +disconnect capability, and does not promise that it is hidden from new users. + +## References + +- [Microsoft Graph delta query](https://learn.microsoft.com/en-us/graph/delta-query-overview) +- [Direct group members and beta workaround](https://learn.microsoft.com/en-us/graph/api/group-list-members?view=graph-rest-1.0) +- [PIM licensing](https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals) +- [Log Analytics cost management](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/cost-logs) +- [Purview data risk graphs](https://go.microsoft.com/fwlink/?linkid=2320023) diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index 726501a2b1b..e6bc31e94be 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -1,3 +1,7 @@ + + | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------------------------------------| | 3.4.0 | 20-07-2026 | Re-added EntraEligibleMembers table (Preview) now that backend ingestion is deployed to all regions | From 16bf0e49eadf5e89224c8adae52721f686210c0a Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Wed, 28 Oct 2026 16:59:18 -0400 Subject: [PATCH 2/7] Use supported tabular parser parameter packaging Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../Parsers/EntraAssetsNormalize.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml index 736d57e8cac..9e337e3465e 100644 --- a/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml +++ b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml @@ -15,7 +15,9 @@ FunctionAlias: EntraAssetsNormalize Function Title: Microsoft Entra ID Assets - Schema Normalization FunctionParams: - Name: T - Type: '(*)' + Type: 'table:(*)' + # Used by KQL validation only; packaging omits defaults for tabular parameters. + Default: 'datatable(_ValidationOnly:string)[]' Category: Microsoft Sentinel Parser id: acfde93c-7e63-4877-870a-2d11e2806f37 FunctionQuery: | From e50285fd351a06afc6853f20b736ab3c6e8e12b0 Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Wed, 28 Oct 2026 17:21:19 -0400 Subject: [PATCH 3/7] Use onboarded Entra tables and generic preview connector identity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../EntraAssetsLogs_ccf/DCR.json | 80 ++--- .../DataConnectorDefinition.json | 224 ++++++------- .../EntraAssetsLogs_ccf/PollingConfig.json | 184 +++++------ .../table_EntraApplicationsV5.json | 112 ------- .../table_EntraDevicesV5.json | 187 ----------- .../table_EntraEligibleMembersV5.json | 62 ---- .../table_EntraGroupMembershipsV5.json | 52 --- .../table_EntraGroupsV5.json | 182 ----------- .../table_EntraMembersV5.json | 62 ---- .../table_EntraOrgContactsV5.json | 117 ------- .../table_EntraOrganizationsV5.json | 132 -------- .../table_EntraOwnersV5.json | 62 ---- .../table_EntraServicePrincipalsV5.json | 137 -------- .../table_EntraSponsorsV5.json | 62 ---- .../table_EntraUsersV5.json | 302 ------------------ ...EntraIDAssets_DataConnectorDefinition.json | 2 +- .../Data/Solution_MicrosoftEntraAssets.json | 2 +- .../Parsers/EntraAssetsNormalize.yaml | 4 +- Solutions/Microsoft Entra ID Assets/README.md | 54 ++-- .../Microsoft Entra ID Assets/ReleaseNotes.md | 2 +- 20 files changed, 279 insertions(+), 1742 deletions(-) delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json delete mode 100644 Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json index 3e12db8ff5e..ca9334d7a86 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DCR.json @@ -1,12 +1,12 @@ { - "name": "EntraCombinedV5TestDCR", + "name": "MicrosoftEntraIDAssetsDCR", "apiVersion": "2023-03-11", "type": "Microsoft.Insights/dataCollectionRules", "location": "{{location}}", "properties": { "dataCollectionEndpointId": "{{dataCollectionEndpointId}}", "streamDeclarations": { - "Custom-EntraApplicationsV5_CL": { + "Custom-EntraApplications_CL": { "columns": [ { "name": "appId", @@ -78,7 +78,7 @@ } ] }, - "Custom-EntraDevicesV5_CL": { + "Custom-EntraDevices_CL": { "columns": [ { "name": "accountEnabled", @@ -210,7 +210,7 @@ } ] }, - "Custom-EntraGroupsV5_CL": { + "Custom-EntraGroups_CL": { "columns": [ { "name": "classification", @@ -338,7 +338,7 @@ } ] }, - "Custom-EntraOrgContactsV5_CL": { + "Custom-EntraOrgContacts_CL": { "columns": [ { "name": "addresses", @@ -414,7 +414,7 @@ } ] }, - "Custom-EntraServicePrincipalsV5_CL": { + "Custom-EntraServicePrincipals_CL": { "columns": [ { "name": "accountEnabled", @@ -506,7 +506,7 @@ } ] }, - "Custom-EntraUsersV5_CL": { + "Custom-EntraUsers_CL": { "columns": [ { "name": "accountEnabled", @@ -730,7 +730,7 @@ } ] }, - "Custom-EntraOrganizationsV5_CL": { + "Custom-EntraOrganizations_CL": { "columns": [ { "name": "businessPhones", @@ -818,7 +818,7 @@ } ] }, - "Custom-EntraGroupMembershipsV5_CL": { + "Custom-EntraGroupMemberships_CL": { "columns": [ { "name": "aadTenantId", @@ -838,7 +838,7 @@ } ] }, - "Custom-EntraMembersV5_CL": { + "Custom-EntraMembers_CL": { "columns": [ { "name": "sourceType", @@ -862,7 +862,7 @@ } ] }, - "Custom-EntraOwnersV5_CL": { + "Custom-EntraOwners_CL": { "columns": [ { "name": "sourceType", @@ -886,7 +886,7 @@ } ] }, - "Custom-EntraSponsorsV5_CL": { + "Custom-EntraSponsors_CL": { "columns": [ { "name": "sourceType", @@ -910,7 +910,7 @@ } ] }, - "Custom-EntraEligibleMembersV5_CL": { + "Custom-EntraEligibleMembers_CL": { "columns": [ { "name": "sourceType", @@ -934,7 +934,7 @@ } ] }, - "Custom-EntraEligibleRoleMembersV5_CL": { + "Custom-EntraEligibleRoleMembers_CL": { "columns": [ { "name": "sourceType", @@ -994,132 +994,132 @@ "dataFlows": [ { "streams": [ - "Custom-EntraApplicationsV5_CL" + "Custom-EntraApplications_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraApplicationsV5_CL", + "outputStream": "Microsoft-EntraApplications", "transformKql": "source | extend TimeGenerated = now() , AppId = ['appId'] , CreatedDateTime = ['createdDateTime'] , Description = ['description'] , DisplayName = ['displayName'] , GroupMembershipClaims = ['groupMembershipClaims'] , Id = ['id'] , IdentifierUris = ['identifierUris'] , IsDeviceOnlyAuthSupported = ['isDeviceOnlyAuthSupported'] , IsFallbackPublicClient = ['isFallbackPublicClient'] , Notes = ['notes'] , PublisherDomain = ['publisherDomain'] , Tags = ['tags'] , UniqueName = ['uniqueName'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AppId , CreatedDateTime , Description , DisplayName , GroupMembershipClaims , Id , IdentifierUris , IsDeviceOnlyAuthSupported , IsFallbackPublicClient , Notes , PublisherDomain , Tags , UniqueName , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraDevicesV5_CL" + "Custom-EntraDevices_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraDevicesV5_CL", + "outputStream": "Microsoft-EntraDevices", "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AlternativeSecurityIds = ['alternativeSecurityIds'] , ApproximateLastSignInDateTime = ['approximateLastSignInDateTime'] , DeviceCategory = ['deviceCategory'] , DeviceId = ['deviceId'] , Id = ['id'] , DeviceMetadata = ['deviceMetadata'] , DeviceOwnership = ['deviceOwnership'] , DeviceVersion = ['deviceVersion'] , DisplayName = ['displayName'] , EnrollmentProfileName = ['enrollmentProfileName'] , EnrollmentType = ['enrollmentType'] , IsCompliant = ['isCompliant'] , IsManaged = ['isManaged'] , IsRooted = ['isRooted'] , ManagementType = ['managementType'] , Manufacturer = ['manufacturer'] , MdmAppId = ['mdmAppId'] , Model = ['model'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OperatingSystem = ['operatingSystem'] , OperatingSystemVersion = ['operatingSystemVersion'] , PhysicalIds = ['physicalIds'] , ProfileType = ['profileType'] , RegistrationDateTime = ['registrationDateTime'] , SystemLabels = ['systemLabels'] , TrustType = ['trustType'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AlternativeSecurityIds , ApproximateLastSignInDateTime , DeviceCategory , DeviceId , Id , DeviceMetadata , DeviceOwnership , DeviceVersion , DisplayName , EnrollmentProfileName , EnrollmentType , IsCompliant , IsManaged , IsRooted , ManagementType , Manufacturer , MdmAppId , Model , OnPremisesLastSyncDateTime , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , OperatingSystem , OperatingSystemVersion , PhysicalIds , ProfileType , RegistrationDateTime , SystemLabels , TrustType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraGroupsV5_CL" + "Custom-EntraGroups_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraGroupsV5_CL", + "outputStream": "Microsoft-EntraGroups", "transformKql": "source | extend TimeGenerated = now() , Classification = ['classification'] , CreatedDateTime = ['createdDateTime'] , Description = ['description'] , DisplayName = ['displayName'] , ExpirationDateTime = ['expirationDateTime'] , GroupTypes = ['groupTypes'] , Id = ['id'] , IsAssignableToRole = ['isAssignableToRole'] , IsManagementRestricted = ['isManagementRestricted'] , Mail = ['mail'] , MailEnabled = ['mailEnabled'] , MailNickname = ['mailNickname'] , MembershipRule = ['membershipRule'] , MembershipRuleProcessingState = ['membershipRuleProcessingState'] , OnPremisesDomainName = ['onPremisesDomainName'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesNetBiosName = ['onPremisesNetBiosName'] , OnPremisesSamAccountName = ['onPremisesSamAccountName'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , PreferredDataLocation = ['preferredDataLocation'] , PreferredLanguage = ['preferredLanguage'] , ProxyAddresses = ['proxyAddresses'] , RenewedDateTime = ['renewedDateTime'] , SecurityEnabled = ['securityEnabled'] , Theme = ['theme'] , UniqueName = ['uniqueName'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , Classification , CreatedDateTime , Description , DisplayName , ExpirationDateTime , GroupTypes , Id , IsAssignableToRole , IsManagementRestricted , Mail , MailEnabled , MailNickname , MembershipRule , MembershipRuleProcessingState , OnPremisesDomainName , OnPremisesLastSyncDateTime , OnPremisesNetBiosName , OnPremisesSamAccountName , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , PreferredDataLocation , PreferredLanguage , ProxyAddresses , RenewedDateTime , SecurityEnabled , Theme , UniqueName , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraOrgContactsV5_CL" + "Custom-EntraOrgContacts_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraOrgContactsV5_CL", + "outputStream": "Microsoft-EntraOrgContacts", "transformKql": "source | extend TimeGenerated = now() , Addresses = ['addresses'] , CompanyName = ['companyName'] , Department = ['department'] , DisplayName = ['displayName'] , GivenName = ['givenName'] , JobTitle = ['jobTitle'] , Mail = ['mail'] , MailNickname = ['mailNickname'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesProvisioningErrors = ['onPremisesProvisioningErrors'] , ProxyAddresses = ['proxyAddresses'] , Surname = ['surname'] , Phones = ['phones'] , Id = ['id'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , Addresses , CompanyName , Department , DisplayName , GivenName , JobTitle , Mail , MailNickname , OnPremisesSyncEnabled , OnPremisesLastSyncDateTime , OnPremisesProvisioningErrors , ProxyAddresses , Surname , Phones , Id , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraServicePrincipalsV5_CL" + "Custom-EntraServicePrincipals_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraServicePrincipalsV5_CL", + "outputStream": "Microsoft-EntraServicePrincipals", "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AlternativeNames = ['alternativeNames'] , AppId = ['appId'] , ApplicationTemplateId = ['applicationTemplateId'] , AppOwnerOrganizationId = ['appOwnerOrganizationId'] , AppRoleAssignmentRequired = ['appRoleAssignmentRequired'] , Description = ['description'] , DisplayName = ['displayName'] , Homepage = ['homepage'] , Id = ['id'] , LoginUrl = ['loginUrl'] , Notes = ['notes'] , NotificationEmailAddresses = ['notificationEmailAddresses'] , PreferredSingleSignOnMode = ['preferredSingleSignOnMode'] , PreferredTokenSigningKeyThumbprint = ['preferredTokenSigningKeyThumbprint'] , ServicePrincipalNames = ['servicePrincipalNames'] , ServicePrincipalType = ['servicePrincipalType'] , Tags = ['tags'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AlternativeNames , AppId , ApplicationTemplateId , AppOwnerOrganizationId , AppRoleAssignmentRequired , Description , DisplayName , Homepage , Id , LoginUrl , Notes , NotificationEmailAddresses , PreferredSingleSignOnMode , PreferredTokenSigningKeyThumbprint , ServicePrincipalNames , ServicePrincipalType , Tags , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraUsersV5_CL" + "Custom-EntraUsers_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraUsersV5_CL", + "outputStream": "Microsoft-EntraUsers", "transformKql": "source | extend TimeGenerated = now() , AccountEnabled = ['accountEnabled'] , AgeGroup = ['ageGroup'] , BusinessPhones = tostring(['businessPhones']) , City = ['city'] , CompanyName = ['companyName'] , ConsentProvidedForMinor = ['consentProvidedForMinor'] , Country = ['country'] , CreatedDateTime = ['createdDateTime'] , CreationType = ['creationType'] , Department = ['department'] , DisplayName = ['displayName'] , EmployeeHireDate = ['employeeHireDate'] , EmployeeId = ['employeeId'] , EmployeeLeaveDateTime = ['employeeLeaveDateTime'] , EmployeeType = ['employeeType'] , ExternalUserState = ['externalUserState'] , ExternalUserStateChangeDateTime = ['externalUserStateChangeDateTime'] , FaxNumber = ['faxNumber'] , GivenName = ['givenName'] , Id = ['id'] , IsManagementRestricted = ['isManagementRestricted'] , IsResourceAccount = ['isResourceAccount'] , JobTitle = ['jobTitle'] , LastPasswordChangeDateTime = ['lastPasswordChangeDateTime'] , LegalAgeGroupClassification = ['legalAgeGroupClassification'] , Mail = ['mail'] , MailNickname = ['mailNickname'] , MobilePhone = ['mobilePhone'] , OfficeLocation = ['officeLocation'] , OnPremisesDistinguishedName = ['onPremisesDistinguishedName'] , OnPremisesDomainName = ['onPremisesDomainName'] , OnPremisesImmutableId = ['onPremisesImmutableId'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSamAccountName = ['onPremisesSamAccountName'] , OnPremisesSecurityIdentifier = ['onPremisesSecurityIdentifier'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , OnPremisesUserPrincipalName = ['onPremisesUserPrincipalName'] , OtherMails = ['otherMails'] , PasswordPolicies = ['passwordPolicies'] , PostalCode = ['postalCode'] , PreferredDataLocation = ['preferredDataLocation'] , PreferredLanguage = ['preferredLanguage'] , ProxyAddresses = ['proxyAddresses'] , ShowInAddressList = ['showInAddressList'] , SignInSessionsValidFromDateTime = ['signInSessionsValidFromDateTime'] , State = ['state'] , StreetAddress = ['streetAddress'] , Surname = ['surname'] , UsageLocation = ['usageLocation'] , UserPrincipalName = ['userPrincipalName'] , UserType = ['userType'] , AADTenantId = ['aadTenantId'] , DeletedDateTime = ['deletedDateTime'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , AccountEnabled , AgeGroup , BusinessPhones , City , CompanyName , ConsentProvidedForMinor , Country , CreatedDateTime , CreationType , Department , DisplayName , EmployeeHireDate , EmployeeId , EmployeeLeaveDateTime , EmployeeType , ExternalUserState , ExternalUserStateChangeDateTime , FaxNumber , GivenName , Id , IsManagementRestricted , IsResourceAccount , JobTitle , LastPasswordChangeDateTime , LegalAgeGroupClassification , Mail , MailNickname , MobilePhone , OfficeLocation , OnPremisesDistinguishedName , OnPremisesDomainName , OnPremisesImmutableId , OnPremisesLastSyncDateTime , OnPremisesSamAccountName , OnPremisesSecurityIdentifier , OnPremisesSyncEnabled , OnPremisesUserPrincipalName , OtherMails , PasswordPolicies , PostalCode , PreferredDataLocation , PreferredLanguage , ProxyAddresses , ShowInAddressList , SignInSessionsValidFromDateTime , State , StreetAddress , Surname , UsageLocation , UserPrincipalName , UserType , AADTenantId , DeletedDateTime , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraOrganizationsV5_CL" + "Custom-EntraOrganizations_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraOrganizationsV5_CL", + "outputStream": "Microsoft-EntraOrganizations", "transformKql": "source | extend TimeGenerated = now() , BusinessPhones = tostring(['businessPhones']) , City = ['city'] , Country = ['country'] , CountryLetterCode = ['countryLetterCode'] , CreatedDateTime = ['createdDateTime'] , DefaultUsageLocation = ['defaultUsageLocation'] , DisplayName = ['displayName'] , Id = ['id'] , MarketingNotificationEmails = ['marketingNotificationEmails'] , OnPremisesLastSyncDateTime = ['onPremisesLastSyncDateTime'] , OnPremisesSyncEnabled = ['onPremisesSyncEnabled'] , PartnerTenantType = ['partnerTenantType'] , PostalCode = ['postalCode'] , PreferredLanguage = ['preferredLanguage'] , SecurityComplianceNotificationMails = ['securityComplianceNotificationMails'] , State = ['state'] , Street = ['street'] , TechnicalNotificationMails = ['technicalNotificationMails'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = isnotnull(['@removed']) | project TimeGenerated , BusinessPhones , City , Country , CountryLetterCode , CreatedDateTime , DefaultUsageLocation , DisplayName , Id , MarketingNotificationEmails , OnPremisesLastSyncDateTime , OnPremisesSyncEnabled , PartnerTenantType , PostalCode , PreferredLanguage , SecurityComplianceNotificationMails , State , Street , TechnicalNotificationMails , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraGroupMembershipsV5_CL" + "Custom-EntraGroupMemberships_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraGroupMembershipsV5_CL", + "outputStream": "Microsoft-EntraGroupMemberships", "transformKql": "source | extend TimeGenerated = now() , AADTenantId = ['aadTenantId'] , SourceId = tostring(group.id) , TargetId = tostring(expand.id) , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , AADTenantId , SourceId , TargetId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraMembersV5_CL" + "Custom-EntraMembers_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraMembersV5_CL", + "outputStream": "Microsoft-EntraMembers", "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = tostring(group.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , TargetId = tostring(expand.id) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraOwnersV5_CL" + "Custom-EntraOwners_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraOwnersV5_CL", + "outputStream": "Microsoft-EntraOwners", "transformKql": "source | extend TimeGenerated = now() , SourceId = tostring(group.id) , SourceType = ['sourceType'] , TargetId = tostring(expand.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceId , SourceType , TargetId , TargetType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraSponsorsV5_CL" + "Custom-EntraSponsors_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraSponsorsV5_CL", + "outputStream": "Microsoft-EntraSponsors", "transformKql": "source | extend TimeGenerated = now() , SourceId = tostring(group.id) , SourceType = ['sourceType'] , TargetId = tostring(expand.id) , TargetType = iff(tostring(expand['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand['@odata.type']), 17), tostring(expand['@odata.type'])) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) | project TimeGenerated , SourceId , SourceType , TargetId , TargetType , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraEligibleMembersV5_CL" + "Custom-EntraEligibleMembers_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraEligibleMembersV5_CL", + "outputStream": "Microsoft-EntraEligibleMembers", "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = tostring(expand.groupId) , TargetType = iff(tostring(expand.principal['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(expand.principal['@odata.type']), 17), tostring(expand.principal['@odata.type'])) , TargetId = tostring(expand.principalId) , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where isnotempty(SourceId) and isnotempty(TargetId) and tostring(expand.accessId) == 'member' and (isempty(tostring(expand.startDateTime)) or todatetime(expand.startDateTime) <= now()) and (isempty(tostring(expand.endDateTime)) or todatetime(expand.endDateTime) > now()) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" }, { "streams": [ - "Custom-EntraEligibleRoleMembersV5_CL" + "Custom-EntraEligibleRoleMembers_CL" ], "destinations": [ "clv2ws1" ], - "outputStream": "Custom-EntraEligibleMembersV5_CL", + "outputStream": "Microsoft-EntraEligibleMembers", "transformKql": "source | extend TimeGenerated = now() , SourceType = ['sourceType'] , SourceId = ['roleDefinitionId'] , TargetType = iff(tostring(principal['@odata.type']) startswith_cs '#microsoft.graph.', substring(tostring(principal['@odata.type']), 17), tostring(principal['@odata.type'])) , TargetId = ['principalId'] , AADTenantId = ['aadTenantId'] , FeedType = ['feedType'] , FeedTypeVersion = iff(feedType == 'Snapshot', tostring(startofweek(now())), '') , IsAssetRemoved = false | where (isnull(startDateTime) or startDateTime <= now()) and (isnull(endDateTime) or endDateTime > now()) | project TimeGenerated , SourceType , SourceId , TargetType , TargetId , AADTenantId , FeedType , FeedTypeVersion , IsAssetRemoved" } ] diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json index 6d2e41d2392..984820e8c13 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -1,224 +1,224 @@ { - "name": "EntraCombinedV5Test", + "name": "MicrosoftEntraIDAssetsCCF", "apiVersion": "2025-09-01", "type": "Microsoft.SecurityInsights/dataConnectorDefinitions", "location": "{{location}}", "kind": "Customizable", "properties": { "connectorUiConfig": { - "id": "EntraCombinedV5Test", - "title": "Entra ID Assets (via MS Graph)", + "id": "MicrosoftEntraIDAssetsCCF", + "title": "Microsoft Entra ID Assets (Preview)", "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/AADCloudSync.svg", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Entra assets include users, groups, applications, service principals and devices, together with their membership and ownership relationships. Collect this inventory in Microsoft Sentinel with weekly snapshots and hourly changefeeds where supported.", "graphQueries": [ { - "metricName": "EntraApplicationsV5_CL observations", - "legend": "EntraApplicationsV5_CL", - "baseQuery": "EntraApplicationsV5_CL" + "metricName": "EntraApplications observations", + "legend": "EntraApplications", + "baseQuery": "EntraApplications" }, { - "metricName": "EntraDevicesV5_CL observations", - "legend": "EntraDevicesV5_CL", - "baseQuery": "EntraDevicesV5_CL" + "metricName": "EntraDevices observations", + "legend": "EntraDevices", + "baseQuery": "EntraDevices" }, { - "metricName": "EntraGroupsV5_CL observations", - "legend": "EntraGroupsV5_CL", - "baseQuery": "EntraGroupsV5_CL" + "metricName": "EntraGroups observations", + "legend": "EntraGroups", + "baseQuery": "EntraGroups" }, { - "metricName": "EntraOrgContactsV5_CL observations", - "legend": "EntraOrgContactsV5_CL", - "baseQuery": "EntraOrgContactsV5_CL" + "metricName": "EntraOrgContacts observations", + "legend": "EntraOrgContacts", + "baseQuery": "EntraOrgContacts" }, { - "metricName": "EntraServicePrincipalsV5_CL observations", - "legend": "EntraServicePrincipalsV5_CL", - "baseQuery": "EntraServicePrincipalsV5_CL" + "metricName": "EntraServicePrincipals observations", + "legend": "EntraServicePrincipals", + "baseQuery": "EntraServicePrincipals" }, { - "metricName": "EntraUsersV5_CL observations", - "legend": "EntraUsersV5_CL", - "baseQuery": "EntraUsersV5_CL" + "metricName": "EntraUsers observations", + "legend": "EntraUsers", + "baseQuery": "EntraUsers" }, { - "metricName": "EntraOrganizationsV5_CL observations", - "legend": "EntraOrganizationsV5_CL", - "baseQuery": "EntraOrganizationsV5_CL" + "metricName": "EntraOrganizations observations", + "legend": "EntraOrganizations", + "baseQuery": "EntraOrganizations" }, { - "metricName": "EntraGroupMembershipsV5_CL observations", - "legend": "EntraGroupMembershipsV5_CL", - "baseQuery": "EntraGroupMembershipsV5_CL" + "metricName": "EntraGroupMemberships observations", + "legend": "EntraGroupMemberships", + "baseQuery": "EntraGroupMemberships" }, { - "metricName": "EntraMembersV5_CL observations", - "legend": "EntraMembersV5_CL", - "baseQuery": "EntraMembersV5_CL" + "metricName": "EntraMembers observations", + "legend": "EntraMembers", + "baseQuery": "EntraMembers" }, { - "metricName": "EntraOwnersV5_CL observations", - "legend": "EntraOwnersV5_CL", - "baseQuery": "EntraOwnersV5_CL" + "metricName": "EntraOwners observations", + "legend": "EntraOwners", + "baseQuery": "EntraOwners" }, { - "metricName": "EntraSponsorsV5_CL observations", - "legend": "EntraSponsorsV5_CL", - "baseQuery": "EntraSponsorsV5_CL" + "metricName": "EntraSponsors observations", + "legend": "EntraSponsors", + "baseQuery": "EntraSponsors" }, { - "metricName": "EntraEligibleMembersV5_CL observations", - "legend": "EntraEligibleMembersV5_CL", - "baseQuery": "EntraEligibleMembersV5_CL" + "metricName": "EntraEligibleMembers observations", + "legend": "EntraEligibleMembers", + "baseQuery": "EntraEligibleMembers" } ], "sampleQueries": [ { - "description": "Recent EntraApplicationsV5_CL", - "query": "EntraApplicationsV5_CL | take 100" + "description": "Recent EntraApplications", + "query": "EntraApplications | take 100" }, { - "description": "EntraApplicationsV5_CL freshness", - "query": "EntraApplicationsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraApplications freshness", + "query": "EntraApplications | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraDevicesV5_CL", - "query": "EntraDevicesV5_CL | take 100" + "description": "Recent EntraDevices", + "query": "EntraDevices | take 100" }, { - "description": "EntraDevicesV5_CL freshness", - "query": "EntraDevicesV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraDevices freshness", + "query": "EntraDevices | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraGroupsV5_CL", - "query": "EntraGroupsV5_CL | take 100" + "description": "Recent EntraGroups", + "query": "EntraGroups | take 100" }, { - "description": "EntraGroupsV5_CL freshness", - "query": "EntraGroupsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraGroups freshness", + "query": "EntraGroups | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraOrgContactsV5_CL", - "query": "EntraOrgContactsV5_CL | take 100" + "description": "Recent EntraOrgContacts", + "query": "EntraOrgContacts | take 100" }, { - "description": "EntraOrgContactsV5_CL freshness", - "query": "EntraOrgContactsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraOrgContacts freshness", + "query": "EntraOrgContacts | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraServicePrincipalsV5_CL", - "query": "EntraServicePrincipalsV5_CL | take 100" + "description": "Recent EntraServicePrincipals", + "query": "EntraServicePrincipals | take 100" }, { - "description": "EntraServicePrincipalsV5_CL freshness", - "query": "EntraServicePrincipalsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraServicePrincipals freshness", + "query": "EntraServicePrincipals | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraUsersV5_CL", - "query": "EntraUsersV5_CL | take 100" + "description": "Recent EntraUsers", + "query": "EntraUsers | take 100" }, { - "description": "EntraUsersV5_CL freshness", - "query": "EntraUsersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraUsers freshness", + "query": "EntraUsers | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraOrganizationsV5_CL", - "query": "EntraOrganizationsV5_CL | take 100" + "description": "Recent EntraOrganizations", + "query": "EntraOrganizations | take 100" }, { - "description": "EntraOrganizationsV5_CL freshness", - "query": "EntraOrganizationsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraOrganizations freshness", + "query": "EntraOrganizations | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraGroupMembershipsV5_CL", - "query": "EntraGroupMembershipsV5_CL | take 100" + "description": "Recent EntraGroupMemberships", + "query": "EntraGroupMemberships | take 100" }, { - "description": "EntraGroupMembershipsV5_CL freshness", - "query": "EntraGroupMembershipsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraGroupMemberships freshness", + "query": "EntraGroupMemberships | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraMembersV5_CL", - "query": "EntraMembersV5_CL | take 100" + "description": "Recent EntraMembers", + "query": "EntraMembers | take 100" }, { - "description": "EntraMembersV5_CL freshness", - "query": "EntraMembersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraMembers freshness", + "query": "EntraMembers | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraOwnersV5_CL", - "query": "EntraOwnersV5_CL | take 100" + "description": "Recent EntraOwners", + "query": "EntraOwners | take 100" }, { - "description": "EntraOwnersV5_CL freshness", - "query": "EntraOwnersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraOwners freshness", + "query": "EntraOwners | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraSponsorsV5_CL", - "query": "EntraSponsorsV5_CL | take 100" + "description": "Recent EntraSponsors", + "query": "EntraSponsors | take 100" }, { - "description": "EntraSponsorsV5_CL freshness", - "query": "EntraSponsorsV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraSponsors freshness", + "query": "EntraSponsors | summarize LastObservation=max(TimeGenerated) by AADTenantId" }, { - "description": "Recent EntraEligibleMembersV5_CL", - "query": "EntraEligibleMembersV5_CL | take 100" + "description": "Recent EntraEligibleMembers", + "query": "EntraEligibleMembers | take 100" }, { - "description": "EntraEligibleMembersV5_CL freshness", - "query": "EntraEligibleMembersV5_CL | summarize LastObservation=max(TimeGenerated) by AADTenantId" + "description": "EntraEligibleMembers freshness", + "query": "EntraEligibleMembers | summarize LastObservation=max(TimeGenerated) by AADTenantId" } ], "dataTypes": [ { - "name": "EntraApplicationsV5_CL", - "lastDataReceivedQuery": "EntraApplicationsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraApplications", + "lastDataReceivedQuery": "EntraApplications\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraDevicesV5_CL", - "lastDataReceivedQuery": "EntraDevicesV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraDevices", + "lastDataReceivedQuery": "EntraDevices\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraGroupsV5_CL", - "lastDataReceivedQuery": "EntraGroupsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraGroups", + "lastDataReceivedQuery": "EntraGroups\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraOrgContactsV5_CL", - "lastDataReceivedQuery": "EntraOrgContactsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraOrgContacts", + "lastDataReceivedQuery": "EntraOrgContacts\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraServicePrincipalsV5_CL", - "lastDataReceivedQuery": "EntraServicePrincipalsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraServicePrincipals", + "lastDataReceivedQuery": "EntraServicePrincipals\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraUsersV5_CL", - "lastDataReceivedQuery": "EntraUsersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraUsers", + "lastDataReceivedQuery": "EntraUsers\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraOrganizationsV5_CL", - "lastDataReceivedQuery": "EntraOrganizationsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraOrganizations", + "lastDataReceivedQuery": "EntraOrganizations\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraGroupMembershipsV5_CL", - "lastDataReceivedQuery": "EntraGroupMembershipsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraGroupMemberships", + "lastDataReceivedQuery": "EntraGroupMemberships\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraMembersV5_CL", - "lastDataReceivedQuery": "EntraMembersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraMembers", + "lastDataReceivedQuery": "EntraMembers\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraOwnersV5_CL", - "lastDataReceivedQuery": "EntraOwnersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraOwners", + "lastDataReceivedQuery": "EntraOwners\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraSponsorsV5_CL", - "lastDataReceivedQuery": "EntraSponsorsV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraSponsors", + "lastDataReceivedQuery": "EntraSponsors\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" }, { - "name": "EntraEligibleMembersV5_CL", - "lastDataReceivedQuery": "EntraEligibleMembersV5_CL\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" + "name": "EntraEligibleMembers", + "lastDataReceivedQuery": "EntraEligibleMembers\n| where TimeGenerated > ago(192h)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)" } ], "connectivityCriteria": [ @@ -291,7 +291,7 @@ { "type": "Markdown", "parameters": { - "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** Includes a Graph beta endpoint; unsupported for production applications.\n\n**Weekly snapshot-only tables:** EntraOrganizationsV5_CL, EntraMembersV5_CL, EntraOwnersV5_CL, EntraGroupMembershipsV5_CL, EntraSponsorsV5_CL and EntraEligibleMembersV5_CL have no changefeed configured and receive only weekly snapshots, not hourly updates.\n\n**Warning:** Sponsors, GroupMemberships and EligibleMembers snapshots may take up to 5 days in large tenants, or longer with throttling. This is an estimate, not a guaranteed maximum or SLA; early rows do not indicate completion.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required. If eligibility fails, other collectors may still be connected; verify their deployment status." + "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** Includes a Graph beta endpoint; unsupported for production applications.\n\n**Weekly snapshot-only tables:** EntraOrganizations, EntraMembers, EntraOwners, EntraGroupMemberships, EntraSponsors and EntraEligibleMembers have no changefeed configured and receive only weekly snapshots, not hourly updates.\n\n**Warning:** Sponsors, GroupMemberships and EligibleMembers snapshots may take up to 5 days in large tenants, or longer with throttling. This is an estimate, not a guaranteed maximum or SLA; early rows do not indicate completion.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required. If eligibility fails, other collectors may still be connected; verify their deployment status." } }, { diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json index b194147a15a..d1977ac2cb1 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json @@ -2,7 +2,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupMemberships' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupMemberships' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -98,10 +98,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraGroupMembershipsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraGroupMemberships", "dcrConfig": { - "streamName": "Custom-EntraGroupMembershipsV5_CL", + "streamName": "Custom-EntraGroupMemberships_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -119,7 +119,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupMembers' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupMembers' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -210,10 +210,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraMembersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraMembers", "dcrConfig": { - "streamName": "Custom-EntraMembersV5_CL", + "streamName": "Custom-EntraMembers_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -231,7 +231,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestRoleMembers' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFRoleMembers' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -322,10 +322,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraMembersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraMembers", "dcrConfig": { - "streamName": "Custom-EntraMembersV5_CL", + "streamName": "Custom-EntraMembers_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -343,7 +343,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupOwners' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupOwners' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -434,10 +434,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOwnersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", "dcrConfig": { - "streamName": "Custom-EntraOwnersV5_CL", + "streamName": "Custom-EntraOwners_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -455,7 +455,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestApplicationOwners' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFApplicationOwners' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -546,10 +546,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOwnersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", "dcrConfig": { - "streamName": "Custom-EntraOwnersV5_CL", + "streamName": "Custom-EntraOwners_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -567,7 +567,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestServicePrincipalOwners' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFServicePrincipalOwners' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -658,10 +658,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOwnersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", "dcrConfig": { - "streamName": "Custom-EntraOwnersV5_CL", + "streamName": "Custom-EntraOwners_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -679,7 +679,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestDeviceOwners' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFDeviceOwners' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -770,10 +770,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOwnersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOwners", "dcrConfig": { - "streamName": "Custom-EntraOwnersV5_CL", + "streamName": "Custom-EntraOwners_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -791,7 +791,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestUserSponsors' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFUserSponsors' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -882,10 +882,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraSponsorsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraSponsors", "dcrConfig": { - "streamName": "Custom-EntraSponsorsV5_CL", + "streamName": "Custom-EntraSponsors_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -903,7 +903,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestEligibleGroupMembers' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFEligibleGroupMembers' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -995,10 +995,10 @@ } } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraEligibleMembersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraEligibleMembers", "dcrConfig": { - "streamName": "Custom-EntraEligibleMembersV5_CL", + "streamName": "Custom-EntraEligibleMembers_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1016,7 +1016,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestEligibleRoleMembers' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFEligibleRoleMembers' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1062,10 +1062,10 @@ "timeoutInSeconds": 30, "queryParameters": {} }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraEligibleMembersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraEligibleMembers", "dcrConfig": { - "streamName": "Custom-EntraEligibleRoleMembersV5_CL", + "streamName": "Custom-EntraEligibleRoleMembers_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1080,7 +1080,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestApplicationsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFApplicationsSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1132,10 +1132,10 @@ "$top": "1" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraApplicationsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraApplications", "dcrConfig": { - "streamName": "Custom-EntraApplicationsV5_CL", + "streamName": "Custom-EntraApplications_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1149,7 +1149,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestApplicationsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFApplicationsChangefeed' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1198,10 +1198,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraApplicationsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraApplications", "dcrConfig": { - "streamName": "Custom-EntraApplicationsV5_CL", + "streamName": "Custom-EntraApplications_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1215,7 +1215,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestDevicesSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFDevicesSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1267,10 +1267,10 @@ "$top": "1" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraDevicesV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraDevices", "dcrConfig": { - "streamName": "Custom-EntraDevicesV5_CL", + "streamName": "Custom-EntraDevices_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1284,7 +1284,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestDevicesChangefeed' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFDevicesChangefeed' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1333,10 +1333,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraDevicesV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraDevices", "dcrConfig": { - "streamName": "Custom-EntraDevicesV5_CL", + "streamName": "Custom-EntraDevices_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1350,7 +1350,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupsSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1402,10 +1402,10 @@ "$top": "1" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraGroupsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraGroups", "dcrConfig": { - "streamName": "Custom-EntraGroupsV5_CL", + "streamName": "Custom-EntraGroups_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1419,7 +1419,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestGroupsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFGroupsChangefeed' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1468,10 +1468,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraGroupsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraGroups", "dcrConfig": { - "streamName": "Custom-EntraGroupsV5_CL", + "streamName": "Custom-EntraGroups_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1485,7 +1485,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestOrgContactsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFOrgContactsSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1537,10 +1537,10 @@ "$top": "1" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOrgContactsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOrgContacts", "dcrConfig": { - "streamName": "Custom-EntraOrgContactsV5_CL", + "streamName": "Custom-EntraOrgContacts_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1554,7 +1554,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestOrgContactsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFOrgContactsChangefeed' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1603,10 +1603,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOrgContactsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOrgContacts", "dcrConfig": { - "streamName": "Custom-EntraOrgContactsV5_CL", + "streamName": "Custom-EntraOrgContacts_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1620,7 +1620,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestServicePrincipalsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFServicePrincipalsSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1672,10 +1672,10 @@ "$top": "1" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraServicePrincipalsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraServicePrincipals", "dcrConfig": { - "streamName": "Custom-EntraServicePrincipalsV5_CL", + "streamName": "Custom-EntraServicePrincipals_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1689,7 +1689,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestServicePrincipalsChangefeed' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFServicePrincipalsChangefeed' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1738,10 +1738,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraServicePrincipalsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraServicePrincipals", "dcrConfig": { - "streamName": "Custom-EntraServicePrincipalsV5_CL", + "streamName": "Custom-EntraServicePrincipals_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1755,7 +1755,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestUsersSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFUsersSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1807,10 +1807,10 @@ "$top": "1" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraUsersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraUsers", "dcrConfig": { - "streamName": "Custom-EntraUsersV5_CL", + "streamName": "Custom-EntraUsers_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1824,7 +1824,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestUsersChangefeed' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFUsersChangefeed' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1873,10 +1873,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraUsersV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraUsers", "dcrConfig": { - "streamName": "Custom-EntraUsersV5_CL", + "streamName": "Custom-EntraUsers_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, @@ -1890,7 +1890,7 @@ { "type": "Microsoft.SecurityInsights/dataConnectors", "apiVersion": "2025-09-01", - "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','EntraCombinedV5TestOrganizationsSnapshot' , uniqueString(parameters('friendlyName')) )]", + "name": "[[concat(parameters('workspace'), '/Microsoft.SecurityInsights/','MicrosoftEntraIDAssetsCCFOrganizationsSnapshot' , uniqueString(parameters('friendlyName')) )]", "location": "{{location}}", "kind": "RestApiPoller", "properties": { @@ -1932,10 +1932,10 @@ "$select": "id" } }, - "connectorDefinitionName": "EntraCombinedV5Test", - "dataType": "EntraOrganizationsV5", + "connectorDefinitionName": "MicrosoftEntraIDAssetsCCF", + "dataType": "EntraOrganizations", "dcrConfig": { - "streamName": "Custom-EntraOrganizationsV5_CL", + "streamName": "Custom-EntraOrganizations_CL", "dataCollectionEndpoint": "{{dataCollectionEndpoint}}", "dataCollectionRuleImmutableId": "{{dataCollectionRuleImmutableId}}" }, diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json deleted file mode 100644 index af36699a9c9..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraApplicationsV5.json +++ /dev/null @@ -1,112 +0,0 @@ -{ - "name": "EntraApplicationsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraApplicationsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraApplicationsV5_CL", - "description": "EntraApplicationsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "AppId", - "type": "string", - "description": "App id" - }, - { - "name": "CreatedDateTime", - "type": "datetime", - "description": "Created date time" - }, - { - "name": "Description", - "type": "string", - "description": "Description" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "GroupMembershipClaims", - "type": "string", - "description": "Group membership claims" - }, - { - "name": "Id", - "type": "string", - "description": "Id" - }, - { - "name": "IdentifierUris", - "type": "dynamic", - "description": "Identifier uris" - }, - { - "name": "IsDeviceOnlyAuthSupported", - "type": "boolean", - "description": "Is device only auth supported" - }, - { - "name": "IsFallbackPublicClient", - "type": "boolean", - "description": "Is fallback public client" - }, - { - "name": "Notes", - "type": "string", - "description": "Notes" - }, - { - "name": "PublisherDomain", - "type": "string", - "description": "Publisher domain" - }, - { - "name": "Tags", - "type": "dynamic", - "description": "Tags" - }, - { - "name": "UniqueName", - "type": "string", - "description": "Unique name" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "DeletedDateTime", - "type": "datetime", - "description": "Deleted date time" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json deleted file mode 100644 index d3c86691efd..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraDevicesV5.json +++ /dev/null @@ -1,187 +0,0 @@ -{ - "name": "EntraDevicesV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraDevicesV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraDevicesV5_CL", - "description": "EntraDevicesV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "AccountEnabled", - "type": "boolean", - "description": "Account enabled" - }, - { - "name": "AlternativeSecurityIds", - "type": "dynamic", - "description": "Alternative security ids" - }, - { - "name": "ApproximateLastSignInDateTime", - "type": "datetime", - "description": "Approximate last sign in date time" - }, - { - "name": "DeviceCategory", - "type": "string", - "description": "Device category" - }, - { - "name": "DeviceId", - "type": "string", - "description": "Device registration ID, distinct from the directory-object Id." - }, - { - "name": "Id", - "type": "string", - "description": "Directory-object ID used by Microsoft Graph delta updates and deletions." - }, - { - "name": "DeviceMetadata", - "type": "string", - "description": "Device metadata" - }, - { - "name": "DeviceOwnership", - "type": "string", - "description": "Device ownership" - }, - { - "name": "DeviceVersion", - "type": "int", - "description": "Device version" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "EnrollmentProfileName", - "type": "string", - "description": "Enrollment profile name" - }, - { - "name": "EnrollmentType", - "type": "string", - "description": "Enrollment type" - }, - { - "name": "IsCompliant", - "type": "boolean", - "description": "Is compliant" - }, - { - "name": "IsManaged", - "type": "boolean", - "description": "Is managed" - }, - { - "name": "IsRooted", - "type": "boolean", - "description": "Is rooted" - }, - { - "name": "ManagementType", - "type": "string", - "description": "Management type" - }, - { - "name": "Manufacturer", - "type": "string", - "description": "Manufacturer" - }, - { - "name": "MdmAppId", - "type": "string", - "description": "Mdm app id" - }, - { - "name": "Model", - "type": "string", - "description": "Model" - }, - { - "name": "OnPremisesLastSyncDateTime", - "type": "datetime", - "description": "On premises last sync date time" - }, - { - "name": "OnPremisesSecurityIdentifier", - "type": "string", - "description": "On premises security identifier" - }, - { - "name": "OnPremisesSyncEnabled", - "type": "boolean", - "description": "On premises sync enabled" - }, - { - "name": "OperatingSystem", - "type": "string", - "description": "Operating system" - }, - { - "name": "OperatingSystemVersion", - "type": "string", - "description": "Operating system version" - }, - { - "name": "PhysicalIds", - "type": "dynamic", - "description": "Physical ids" - }, - { - "name": "ProfileType", - "type": "string", - "description": "Profile type" - }, - { - "name": "RegistrationDateTime", - "type": "datetime", - "description": "Registration date time" - }, - { - "name": "SystemLabels", - "type": "dynamic", - "description": "System labels" - }, - { - "name": "TrustType", - "type": "string", - "description": "Trust type" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json deleted file mode 100644 index fce361a06e8..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraEligibleMembersV5.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "name": "EntraEligibleMembersV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraEligibleMembersV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraEligibleMembersV5_CL", - "description": "EntraEligibleMembersV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "SourceType", - "type": "string", - "description": "Source type" - }, - { - "name": "SourceId", - "type": "string", - "description": "Source id" - }, - { - "name": "TargetType", - "type": "string", - "description": "Target type" - }, - { - "name": "TargetId", - "type": "string", - "description": "Target id" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json deleted file mode 100644 index b506425a6fd..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupMembershipsV5.json +++ /dev/null @@ -1,52 +0,0 @@ -{ - "name": "EntraGroupMembershipsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraGroupMembershipsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraGroupMembershipsV5_CL", - "description": "EntraGroupMembershipsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "SourceId", - "type": "string", - "description": "Source id" - }, - { - "name": "TargetId", - "type": "string", - "description": "Target id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json deleted file mode 100644 index eebd290a973..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraGroupsV5.json +++ /dev/null @@ -1,182 +0,0 @@ -{ - "name": "EntraGroupsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraGroupsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraGroupsV5_CL", - "description": "EntraGroupsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "Classification", - "type": "string", - "description": "Classification" - }, - { - "name": "CreatedDateTime", - "type": "datetime", - "description": "Created date time" - }, - { - "name": "Description", - "type": "string", - "description": "Description" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "ExpirationDateTime", - "type": "datetime", - "description": "Expiration date time" - }, - { - "name": "GroupTypes", - "type": "dynamic", - "description": "Group types" - }, - { - "name": "Id", - "type": "string", - "description": "Id" - }, - { - "name": "IsAssignableToRole", - "type": "boolean", - "description": "Is assignable to role" - }, - { - "name": "IsManagementRestricted", - "type": "boolean", - "description": "Is management restricted" - }, - { - "name": "Mail", - "type": "string", - "description": "Mail" - }, - { - "name": "MailEnabled", - "type": "boolean", - "description": "Mail enabled" - }, - { - "name": "MailNickname", - "type": "string", - "description": "Mail nickname" - }, - { - "name": "MembershipRule", - "type": "string", - "description": "Membership rule" - }, - { - "name": "MembershipRuleProcessingState", - "type": "string", - "description": "Membership rule processing state" - }, - { - "name": "OnPremisesDomainName", - "type": "string", - "description": "On premises domain name" - }, - { - "name": "OnPremisesLastSyncDateTime", - "type": "datetime", - "description": "On premises last sync date time" - }, - { - "name": "OnPremisesNetBiosName", - "type": "string", - "description": "On premises net bios name" - }, - { - "name": "OnPremisesSamAccountName", - "type": "string", - "description": "On premises sam account name" - }, - { - "name": "OnPremisesSecurityIdentifier", - "type": "string", - "description": "On premises security identifier" - }, - { - "name": "OnPremisesSyncEnabled", - "type": "boolean", - "description": "On premises sync enabled" - }, - { - "name": "PreferredDataLocation", - "type": "string", - "description": "Preferred data location" - }, - { - "name": "PreferredLanguage", - "type": "string", - "description": "Preferred language" - }, - { - "name": "ProxyAddresses", - "type": "dynamic", - "description": "Proxy addresses" - }, - { - "name": "RenewedDateTime", - "type": "datetime", - "description": "Renewed date time" - }, - { - "name": "SecurityEnabled", - "type": "boolean", - "description": "Security enabled" - }, - { - "name": "Theme", - "type": "string", - "description": "Theme" - }, - { - "name": "UniqueName", - "type": "string", - "description": "Unique name" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "DeletedDateTime", - "type": "datetime", - "description": "Deleted date time" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json deleted file mode 100644 index 4ca564ebeae..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraMembersV5.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "name": "EntraMembersV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraMembersV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraMembersV5_CL", - "description": "EntraMembersV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "SourceType", - "type": "string", - "description": "Source type" - }, - { - "name": "SourceId", - "type": "string", - "description": "Source id" - }, - { - "name": "TargetType", - "type": "string", - "description": "Target type" - }, - { - "name": "TargetId", - "type": "string", - "description": "Target id" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json deleted file mode 100644 index f95a9b04441..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrgContactsV5.json +++ /dev/null @@ -1,117 +0,0 @@ -{ - "name": "EntraOrgContactsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraOrgContactsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraOrgContactsV5_CL", - "description": "EntraOrgContactsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "Addresses", - "type": "dynamic", - "description": "Addresses" - }, - { - "name": "CompanyName", - "type": "string", - "description": "Company name" - }, - { - "name": "Department", - "type": "string", - "description": "Department" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "GivenName", - "type": "string", - "description": "Given name" - }, - { - "name": "JobTitle", - "type": "string", - "description": "Job title" - }, - { - "name": "Mail", - "type": "string", - "description": "Mail" - }, - { - "name": "MailNickname", - "type": "string", - "description": "Mail nickname" - }, - { - "name": "OnPremisesSyncEnabled", - "type": "boolean", - "description": "On premises sync enabled" - }, - { - "name": "OnPremisesLastSyncDateTime", - "type": "datetime", - "description": "On premises last sync date time" - }, - { - "name": "OnPremisesProvisioningErrors", - "type": "dynamic", - "description": "On premises provisioning errors" - }, - { - "name": "ProxyAddresses", - "type": "dynamic", - "description": "Proxy addresses" - }, - { - "name": "Surname", - "type": "string", - "description": "Surname" - }, - { - "name": "Phones", - "type": "dynamic", - "description": "Phones" - }, - { - "name": "Id", - "type": "string", - "description": "Id" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json deleted file mode 100644 index 155bd4986f9..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOrganizationsV5.json +++ /dev/null @@ -1,132 +0,0 @@ -{ - "name": "EntraOrganizationsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraOrganizationsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraOrganizationsV5_CL", - "description": "EntraOrganizationsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "BusinessPhones", - "type": "string", - "description": "Business phones" - }, - { - "name": "City", - "type": "string", - "description": "City" - }, - { - "name": "Country", - "type": "string", - "description": "Country" - }, - { - "name": "CountryLetterCode", - "type": "string", - "description": "Country letter code" - }, - { - "name": "CreatedDateTime", - "type": "datetime", - "description": "Created date time" - }, - { - "name": "DefaultUsageLocation", - "type": "string", - "description": "Default usage location" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "Id", - "type": "string", - "description": "Id" - }, - { - "name": "MarketingNotificationEmails", - "type": "dynamic", - "description": "Marketing notification emails" - }, - { - "name": "OnPremisesLastSyncDateTime", - "type": "datetime", - "description": "On premises last sync date time" - }, - { - "name": "OnPremisesSyncEnabled", - "type": "boolean", - "description": "On premises sync enabled" - }, - { - "name": "PartnerTenantType", - "type": "string", - "description": "Partner tenant type" - }, - { - "name": "PostalCode", - "type": "string", - "description": "Postal code" - }, - { - "name": "PreferredLanguage", - "type": "string", - "description": "Preferred language" - }, - { - "name": "SecurityComplianceNotificationMails", - "type": "dynamic", - "description": "Security compliance notification mails" - }, - { - "name": "State", - "type": "string", - "description": "State" - }, - { - "name": "Street", - "type": "string", - "description": "Street" - }, - { - "name": "TechnicalNotificationMails", - "type": "dynamic", - "description": "Technical notification mails" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json deleted file mode 100644 index 89faa953efb..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraOwnersV5.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "name": "EntraOwnersV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraOwnersV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraOwnersV5_CL", - "description": "EntraOwnersV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "SourceId", - "type": "string", - "description": "Source id" - }, - { - "name": "SourceType", - "type": "string", - "description": "Source type" - }, - { - "name": "TargetId", - "type": "string", - "description": "Target id" - }, - { - "name": "TargetType", - "type": "string", - "description": "Target type" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json deleted file mode 100644 index b172c74e214..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraServicePrincipalsV5.json +++ /dev/null @@ -1,137 +0,0 @@ -{ - "name": "EntraServicePrincipalsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraServicePrincipalsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraServicePrincipalsV5_CL", - "description": "EntraServicePrincipalsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "AccountEnabled", - "type": "boolean", - "description": "Account enabled" - }, - { - "name": "AlternativeNames", - "type": "dynamic", - "description": "Alternative names" - }, - { - "name": "AppId", - "type": "string", - "description": "App id" - }, - { - "name": "ApplicationTemplateId", - "type": "string", - "description": "Application template id" - }, - { - "name": "AppOwnerOrganizationId", - "type": "string", - "description": "App owner organization id" - }, - { - "name": "AppRoleAssignmentRequired", - "type": "boolean", - "description": "App role assignment required" - }, - { - "name": "Description", - "type": "string", - "description": "Description" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "Homepage", - "type": "string", - "description": "Homepage" - }, - { - "name": "Id", - "type": "string", - "description": "Id" - }, - { - "name": "LoginUrl", - "type": "string", - "description": "Login url" - }, - { - "name": "Notes", - "type": "string", - "description": "Notes" - }, - { - "name": "NotificationEmailAddresses", - "type": "dynamic", - "description": "Notification email addresses" - }, - { - "name": "PreferredSingleSignOnMode", - "type": "string", - "description": "Preferred single sign on mode" - }, - { - "name": "PreferredTokenSigningKeyThumbprint", - "type": "string", - "description": "Preferred token signing key thumbprint" - }, - { - "name": "ServicePrincipalNames", - "type": "dynamic", - "description": "Service principal names" - }, - { - "name": "ServicePrincipalType", - "type": "string", - "description": "Service principal type" - }, - { - "name": "Tags", - "type": "dynamic", - "description": "Tags" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "DeletedDateTime", - "type": "datetime", - "description": "Deleted date time" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json deleted file mode 100644 index f05f556a861..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraSponsorsV5.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "name": "EntraSponsorsV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraSponsorsV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraSponsorsV5_CL", - "description": "EntraSponsorsV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "SourceId", - "type": "string", - "description": "Source id" - }, - { - "name": "SourceType", - "type": "string", - "description": "Source type" - }, - { - "name": "TargetId", - "type": "string", - "description": "Target id" - }, - { - "name": "TargetType", - "type": "string", - "description": "Target type" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json deleted file mode 100644 index c7afa1a2f9f..00000000000 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/table_EntraUsersV5.json +++ /dev/null @@ -1,302 +0,0 @@ -{ - "name": "EntraUsersV5_CL", - "type": "Microsoft.OperationalInsights/workspaces/tables", - "apiVersion": "2023-09-01", - "tags": { - "StreamName": "Custom-EntraUsersV5_CL", - "DataSource": "EntraCombinedV5Test" - }, - "properties": { - "schema": { - "name": "EntraUsersV5_CL", - "description": "EntraUsersV5_CL Microsoft Graph relationship observations", - "columns": [ - { - "name": "AccountEnabled", - "type": "boolean", - "description": "Account enabled" - }, - { - "name": "AgeGroup", - "type": "string", - "description": "Age group" - }, - { - "name": "BusinessPhones", - "type": "string", - "description": "Business phones" - }, - { - "name": "City", - "type": "string", - "description": "City" - }, - { - "name": "CompanyName", - "type": "string", - "description": "Company name" - }, - { - "name": "ConsentProvidedForMinor", - "type": "string", - "description": "Consent provided for minor" - }, - { - "name": "Country", - "type": "string", - "description": "Country" - }, - { - "name": "CreatedDateTime", - "type": "datetime", - "description": "Created date time" - }, - { - "name": "CreationType", - "type": "string", - "description": "Creation type" - }, - { - "name": "Department", - "type": "string", - "description": "Department" - }, - { - "name": "DisplayName", - "type": "string", - "description": "Display name" - }, - { - "name": "EmployeeHireDate", - "type": "datetime", - "description": "Employee hire date" - }, - { - "name": "EmployeeId", - "type": "string", - "description": "Employee id" - }, - { - "name": "EmployeeLeaveDateTime", - "type": "datetime", - "description": "Employee leave date time" - }, - { - "name": "EmployeeType", - "type": "string", - "description": "Employee type" - }, - { - "name": "ExternalUserState", - "type": "string", - "description": "External user state" - }, - { - "name": "ExternalUserStateChangeDateTime", - "type": "datetime", - "description": "External user state change date time" - }, - { - "name": "FaxNumber", - "type": "string", - "description": "Fax number" - }, - { - "name": "GivenName", - "type": "string", - "description": "Given name" - }, - { - "name": "Id", - "type": "string", - "description": "Id" - }, - { - "name": "IsManagementRestricted", - "type": "boolean", - "description": "Is management restricted" - }, - { - "name": "IsResourceAccount", - "type": "boolean", - "description": "Is resource account" - }, - { - "name": "JobTitle", - "type": "string", - "description": "Job title" - }, - { - "name": "LastPasswordChangeDateTime", - "type": "datetime", - "description": "Last password change date time" - }, - { - "name": "LegalAgeGroupClassification", - "type": "string", - "description": "Legal age group classification" - }, - { - "name": "Mail", - "type": "string", - "description": "Mail" - }, - { - "name": "MailNickname", - "type": "string", - "description": "Mail nickname" - }, - { - "name": "MobilePhone", - "type": "string", - "description": "Mobile phone" - }, - { - "name": "OfficeLocation", - "type": "string", - "description": "Office location" - }, - { - "name": "OnPremisesDistinguishedName", - "type": "string", - "description": "On premises distinguished name" - }, - { - "name": "OnPremisesDomainName", - "type": "string", - "description": "On premises domain name" - }, - { - "name": "OnPremisesImmutableId", - "type": "string", - "description": "On premises immutable id" - }, - { - "name": "OnPremisesLastSyncDateTime", - "type": "datetime", - "description": "On premises last sync date time" - }, - { - "name": "OnPremisesSamAccountName", - "type": "string", - "description": "On premises sam account name" - }, - { - "name": "OnPremisesSecurityIdentifier", - "type": "string", - "description": "On premises security identifier" - }, - { - "name": "OnPremisesSyncEnabled", - "type": "boolean", - "description": "On premises sync enabled" - }, - { - "name": "OnPremisesUserPrincipalName", - "type": "string", - "description": "On premises user principal name" - }, - { - "name": "OtherMails", - "type": "dynamic", - "description": "Other mails" - }, - { - "name": "PasswordPolicies", - "type": "string", - "description": "Password policies" - }, - { - "name": "PostalCode", - "type": "string", - "description": "Postal code" - }, - { - "name": "PreferredDataLocation", - "type": "string", - "description": "Preferred data location" - }, - { - "name": "PreferredLanguage", - "type": "string", - "description": "Preferred language" - }, - { - "name": "ProxyAddresses", - "type": "dynamic", - "description": "Proxy addresses" - }, - { - "name": "ShowInAddressList", - "type": "boolean", - "description": "Show in address list" - }, - { - "name": "SignInSessionsValidFromDateTime", - "type": "datetime", - "description": "Sign in sessions valid from date time" - }, - { - "name": "State", - "type": "string", - "description": "State" - }, - { - "name": "StreetAddress", - "type": "string", - "description": "Street address" - }, - { - "name": "Surname", - "type": "string", - "description": "Surname" - }, - { - "name": "UsageLocation", - "type": "string", - "description": "Usage location" - }, - { - "name": "UserPrincipalName", - "type": "string", - "description": "User principal name" - }, - { - "name": "UserType", - "type": "string", - "description": "User type" - }, - { - "name": "AADTenantId", - "type": "string", - "description": "Aad tenant id" - }, - { - "name": "DeletedDateTime", - "type": "datetime", - "description": "Deleted date time" - }, - { - "name": "TimeGenerated", - "type": "datetime", - "description": "Time generated" - }, - { - "name": "FeedType", - "type": "string", - "description": "Feed type" - }, - { - "name": "FeedTypeVersion", - "type": "string", - "description": "UTC calendar-week bucket (Sunday 00:00) at transformation time for snapshots only; not a snapshot run ID." - }, - { - "name": "IsAssetRemoved", - "type": "boolean", - "description": "Is asset removed" - } - ] - } - } -} \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json index b0336623ee6..de5d7d6b28a 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json @@ -3,7 +3,7 @@ "title": "[Deprecated] Microsoft Entra ID Assets", "publisher": "Microsoft", "logo": "AADCloudSync.svg", - "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Entra ID Assets (via MS Graph)**, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", + "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Microsoft Entra ID Assets (Preview)**, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", "graphQueries": [], "sampleQueries": [], "dataTypes": [], diff --git a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json index f23c6447af9..8781686d614 100644 --- a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json +++ b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json @@ -2,7 +2,7 @@ "Name": "Microsoft Entra ID Assets", "Author": "Microsoft", "Logo": "", - "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. The preview Entra ID Assets (via MS Graph) connector ingests inventory into a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes one schema-normalization parser for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).", + "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. Microsoft Entra ID Assets (Preview) ingests inventory into onboarded Entra system tables in a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes Parser for Microsoft Entra ID Assets for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).", "Data Connectors": [ "Data Connectors/EntraIDAssets_DataConnectorDefinition.json", "Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json" diff --git a/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml index 9e337e3465e..3686716882f 100644 --- a/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml +++ b/Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml @@ -1,5 +1,5 @@ Function: - Title: Microsoft Entra ID Assets - Schema Normalization + Title: Parser for Microsoft Entra ID Assets Version: '1.0.0' LastUpdated: '2026-10-28' Product: Microsoft Entra ID @@ -12,7 +12,7 @@ Description: | This does not migrate data or reconstruct snapshot or changefeed state. FunctionName: EntraAssetsNormalize FunctionAlias: EntraAssetsNormalize -Function Title: Microsoft Entra ID Assets - Schema Normalization +Function Title: Parser for Microsoft Entra ID Assets FunctionParams: - Name: T Type: 'table:(*)' diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md index 2441a810e1d..bbd344976ab 100644 --- a/Solutions/Microsoft Entra ID Assets/README.md +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -1,19 +1,18 @@ # Microsoft Entra ID Assets -This solution contains the legacy data-lake connector, the preview **Entra ID Assets -(via MS Graph)** connector for Azure Log Analytics, and one shared schema-normalization +This solution contains the legacy data-lake connector, **Microsoft Entra ID Assets +(Preview)** for Azure Log Analytics, and one shared schema-normalization parser. Deprecation applies to the legacy connector, not to the solution. -> **Draft preview:** The new connector retains isolated `EntraCombinedV5Test` resource -> identities and `V5_CL` custom tables for validation. These are not onboarded Microsoft -> standard tables. Production naming, release readiness, and coordinated publication -> of the replacement and deprecation notice require maintainer review. No retirement -> date or automatic cutover is established by this draft. +> **Draft preview:** The new connector references the onboarded Microsoft-managed +> Entra tables. Release readiness and coordinated publication of the replacement +> and deprecation notice require maintainer review. No retirement date or automatic +> cutover is established by this draft. ## Set up the Graph connector 1. Install the solution in a Microsoft Sentinel-enabled Log Analytics workspace and - open **Entra ID Assets (via MS Graph)**. + open **Microsoft Entra ID Assets (Preview)**. 2. In the workspace's deployment tenant, register a single-tenant Microsoft Entra app. No redirect URI is required. Copy its Application (client) ID, not its Object ID. 3. Add Microsoft Graph **application** permissions and grant administrator consent: @@ -33,20 +32,27 @@ parser. Deprecation applies to the legacy connector, not to the solution. The connector supports multiple named connections. It uses 23 pollers: 17 weekly snapshot paths and six hourly asset changefeeds. -| Dataset | Custom table | Collection | +| Dataset | System table | Collection | | --- | --- | --- | -| Applications | `EntraApplicationsV5_CL` | Weekly snapshot; hourly changes | -| Devices | `EntraDevicesV5_CL` | Weekly snapshot; hourly changes | -| Groups | `EntraGroupsV5_CL` | Weekly snapshot; hourly changes | -| Organizational contacts | `EntraOrgContactsV5_CL` | Weekly snapshot; hourly changes | -| Service principals | `EntraServicePrincipalsV5_CL` | Weekly snapshot; hourly changes | -| Users | `EntraUsersV5_CL` | Weekly snapshot; hourly changes | -| Organizations | `EntraOrganizationsV5_CL` | Weekly snapshot | -| Transitive group user memberships | `EntraGroupMembershipsV5_CL` | Weekly snapshot | -| Direct members | `EntraMembersV5_CL` | Weekly snapshot | -| Owners | `EntraOwnersV5_CL` | Weekly snapshot | -| Sponsors | `EntraSponsorsV5_CL` | Weekly snapshot | -| Eligible members | `EntraEligibleMembersV5_CL` | Weekly snapshot | +| Applications | `EntraApplications` | Weekly snapshot; hourly changes | +| Devices | `EntraDevices` | Weekly snapshot; hourly changes | +| Groups | `EntraGroups` | Weekly snapshot; hourly changes | +| Organizational contacts | `EntraOrgContacts` | Weekly snapshot; hourly changes | +| Service principals | `EntraServicePrincipals` | Weekly snapshot; hourly changes | +| Users | `EntraUsers` | Weekly snapshot; hourly changes | +| Organizations | `EntraOrganizations` | Weekly snapshot | +| Transitive group user memberships | `EntraGroupMemberships` | Weekly snapshot | +| Direct members | `EntraMembers` | Weekly snapshot | +| Owners | `EntraOwners` | Weekly snapshot | +| Sponsors | `EntraSponsors` | Weekly snapshot | +| Eligible members | `EntraEligibleMembers` | Weekly snapshot | + +Use the table names above in queries and poller data types. The DCR routes raw Graph +custom input streams to standard output streams such as `Microsoft-EntraApplications`. +Custom input stream declarations describe the Graph payload; they are not custom +workspace tables. No custom table creation resources are included. +The new connector's internal ID is `MicrosoftEntraIDAssetsCCF`; the legacy connector's +existing ID remains unchanged. ### Collection limitations @@ -65,18 +71,18 @@ snapshot paths and six hourly asset changefeeds. - Sponsors, transitive memberships, and eligibility snapshots can take days in large tenants. The connector's five-day estimate is not a maximum or SLA. Early rows do not establish snapshot completion. -- Complete V5 ingestion and live parser execution have not been established by this +- Complete end-to-end ingestion and live parser execution have not been established by this draft. Validate in a nonproduction workspace before planning a production cutover. ## Schema normalization -**Microsoft Entra ID Assets - Schema Normalization** installs the single function +**Parser for Microsoft Entra ID Assets** installs the single function `EntraAssetsNormalize(T:(*))`. It accepts a queryable asset or relationship table and converts legacy camelCase fields to the PascalCase names and types used by the new connector. It also accepts existing PascalCase input. ```kusto -EntraUsersV5_CL +EntraUsers | invoke EntraAssetsNormalize() | project Id, DisplayName, AADTenantId, AccountEnabled ``` diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index e6bc31e94be..b3a8c1752c9 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -1,5 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | From 50c701cebf6e5e6d67062fcb26cd7005a5f7361e Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Thu, 29 Oct 2026 15:30:08 -0400 Subject: [PATCH 4/7] Add setup-only Entra table selection with explicit disconnect warning Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../DataConnectorDefinition.json | 74 ++++++++++++++++++- .../EntraAssetsLogs_ccf/PollingConfig.json | 69 +++++++++++------ Solutions/Microsoft Entra ID Assets/README.md | 25 ++++++- .../Microsoft Entra ID Assets/ReleaseNotes.md | 2 +- 4 files changed, 140 insertions(+), 30 deletions(-) diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json index 984820e8c13..af389a14261 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -249,8 +249,17 @@ "instructionSteps": [ { "title": "Connections", - "description": "Collect all asset and relationship paths together.", + "description": "Choose the asset and relationship tables to collect.", "instructions": [ + { + "type": "MessageBar", + "parameters": { + "text": "Setup selection only: changing the selection alone does not stop existing pollers. Disconnect/delete a table's existing pollers before reconnecting with a reduced selection. Include both snapshot/changefeed pollers and all relationship paths. Stored data is retained.", + "visible": true, + "inline": false, + "type": "warning" + } + }, { "type": "DataConnectorsGrid", "parameters": { @@ -291,7 +300,68 @@ { "type": "Markdown", "parameters": { - "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** Includes a Graph beta endpoint; unsupported for production applications.\n\n**Weekly snapshot-only tables:** EntraOrganizations, EntraMembers, EntraOwners, EntraGroupMemberships, EntraSponsors and EntraEligibleMembers have no changefeed configured and receive only weekly snapshots, not hourly updates.\n\n**Warning:** Sponsors, GroupMemberships and EligibleMembers snapshots may take up to 5 days in large tenants, or longer with throttling. This is an estimate, not a guaranteed maximum or SLA; early rows do not indicate completion.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required. If eligibility fails, other collectors may still be connected; verify their deployment status." + "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** Includes a Graph beta endpoint; unsupported for production applications.\n\n**Weekly snapshot-only tables:** EntraOrganizations, EntraMembers, EntraOwners, EntraGroupMemberships, EntraSponsors and EntraEligibleMembers have no changefeed configured and receive only weekly snapshots, not hourly updates.\n\n**Warning:** Sponsors, GroupMemberships and EligibleMembers snapshots may take up to 5 days in large tenants, or longer with throttling. This is an estimate, not a guaranteed maximum or SLA; early rows do not indicate completion.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required for the EligibleMembers table. If eligibility fails, other collectors may still be connected; verify their deployment status." + } + }, + { + "type": "Dropdown", + "parameters": { + "label": "Tables to collect", + "name": "selectedDataTypes", + "options": [ + { + "key": "EntraApplications", + "text": "EntraApplications" + }, + { + "key": "EntraDevices", + "text": "EntraDevices" + }, + { + "key": "EntraGroups", + "text": "EntraGroups" + }, + { + "key": "EntraOrgContacts", + "text": "EntraOrgContacts" + }, + { + "key": "EntraServicePrincipals", + "text": "EntraServicePrincipals" + }, + { + "key": "EntraUsers", + "text": "EntraUsers" + }, + { + "key": "EntraOrganizations", + "text": "EntraOrganizations" + }, + { + "key": "EntraGroupMemberships", + "text": "EntraGroupMemberships" + }, + { + "key": "EntraMembers", + "text": "EntraMembers" + }, + { + "key": "EntraOwners", + "text": "EntraOwners" + }, + { + "key": "EntraSponsors", + "text": "EntraSponsors" + }, + { + "key": "EntraEligibleMembers", + "text": "EntraEligibleMembers" + } + ], + "placeholder": "Select tables to collect...", + "isMultiSelect": true, + "defaultAllSelected": true, + "required": true } }, { diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json index d1977ac2cb1..35e22e3f576 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/PollingConfig.json @@ -114,7 +114,8 @@ "sourceType": "group", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraGroupMemberships')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -226,7 +227,8 @@ "sourceType": "group", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraMembers')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -338,7 +340,8 @@ "sourceType": "role", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraMembers')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -450,7 +453,8 @@ "sourceType": "group", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -562,7 +566,8 @@ "sourceType": "application", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -674,7 +679,8 @@ "sourceType": "servicePrincipal", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -786,7 +792,8 @@ "sourceType": "device", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOwners')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -898,7 +905,8 @@ "sourceType": "user", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraSponsors')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1011,7 +1019,8 @@ "sourceType": "group", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraEligibleMembers')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1075,7 +1084,8 @@ "sourceType": "roleDefinition", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraEligibleMembers')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1144,7 +1154,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraApplications')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1210,7 +1221,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Changefeed" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraApplications')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1279,7 +1291,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraDevices')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1345,7 +1358,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Changefeed" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraDevices')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1414,7 +1428,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraGroups')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1480,7 +1495,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Changefeed" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraGroups')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1549,7 +1565,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOrgContacts')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1615,7 +1632,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Changefeed" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOrgContacts')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1684,7 +1702,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraServicePrincipals')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1750,7 +1769,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Changefeed" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraServicePrincipals')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1819,7 +1839,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraUsers')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1885,7 +1906,8 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Changefeed" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraUsers')]" }, { "type": "Microsoft.SecurityInsights/dataConnectors", @@ -1944,6 +1966,7 @@ "friendlyName": "[[parameters('friendlyName')]", "feedType": "Snapshot" } - } + }, + "condition": "[[contains(parameters('selectedDataTypes'), 'EntraOrganizations')]" } ] \ No newline at end of file diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md index bbd344976ab..a5a63542bd7 100644 --- a/Solutions/Microsoft Entra ID Assets/README.md +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -25,12 +25,29 @@ parser. Deprecation applies to the legacy connector, not to the solution. 4. Create a client secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration. Provide a unique connection name, tenant ID, application client ID, and secret through the connector's **Add connection** pane. -5. Check every collector's deployment status and table freshness. Eligibility requires - Microsoft Entra ID P2 or Microsoft Entra ID Governance. A failed eligibility +5. In **Tables to collect**, select at least one table. All twelve are selected by + default. Selecting an asset table enables both its snapshot and hourly changefeed + where supported; selecting a relationship table enables all its collection paths. +6. Check each selected collector's deployment status and table freshness. Collecting + `EntraEligibleMembers` requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. + Leave it unselected if that dataset is not needed or the tenant is not licensed. + A failed eligibility collector does not establish that the other collectors failed or succeeded. -The connector supports multiple named connections. It uses 23 pollers: 17 weekly -snapshot paths and six hourly asset changefeeds. +The connector supports multiple named connections. With every table selected, it +uses 23 pollers: 17 weekly snapshot paths and six hourly asset changefeeds. Only +pollers for the tables selected during setup are deployed. + +### Change or stop collection + +**Tables to collect is a setup selector, not a live on/off switch.** Unchecking a +previously enabled table does not stop or delete its existing pollers. To stop it, +select and delete all poller rows for that table and connection in the connections +grid, including both snapshot/changefeed rows or every relationship path. Reconnect +with the desired selection as needed. Changing the connection name creates a separate +connection; it does not stop the old one. + +Existing table data is retained. In-flight work may still complete after disconnect. | Dataset | System table | Collection | | --- | --- | --- | diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index b3a8c1752c9..c9a77b25644 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -1,5 +1,5 @@ | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | From 111b3e5d897fedd32bce8995a077a36cc901fda2 Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Fri, 30 Oct 2026 09:31:50 -0400 Subject: [PATCH 5/7] Apply reviewed Entra connector description and setup page copy Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../DataConnectorDefinition.json | 14 +++++++++----- Solutions/Microsoft Entra ID Assets/README.md | 5 +++++ .../Microsoft Entra ID Assets/ReleaseNotes.md | 3 ++- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json index af389a14261..9f339c5395b 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -10,7 +10,7 @@ "title": "Microsoft Entra ID Assets (Preview)", "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/AADCloudSync.svg", "publisher": "Microsoft", - "descriptionMarkdown": "Microsoft Entra assets include users, groups, applications, service principals and devices, together with their membership and ownership relationships. Collect this inventory in Microsoft Sentinel with weekly snapshots and hourly changefeeds where supported.", + "descriptionMarkdown": "Microsoft Entra assets include users, groups, applications, service principals and devices, together with their membership and ownership relationships. Collect this inventory in Microsoft Sentinel.", "graphQueries": [ { "metricName": "EntraApplications observations", @@ -234,7 +234,7 @@ "resourceProvider": [ { "provider": "Microsoft.OperationalInsights/workspaces", - "permissionsDisplayText": "Read and Write permissions are required.", + "permissionsDisplayText": "Read and write permissions are required on the workspace targeted for this connection.", "providerDisplayName": "Workspace", "scope": "Workspace", "requiredPermissions": { @@ -244,12 +244,16 @@ "action": false } } + ], + "tenant": [ + "GlobalAdmin", + "SecurityAdmin" ] }, "instructionSteps": [ { - "title": "Connections", - "description": "Choose the asset and relationship tables to collect.", + "title": "Configuration", + "description": "Connect Entra asset data.", "instructions": [ { "type": "MessageBar", @@ -300,7 +304,7 @@ { "type": "Markdown", "parameters": { - "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** Includes a Graph beta endpoint; unsupported for production applications.\n\n**Weekly snapshot-only tables:** EntraOrganizations, EntraMembers, EntraOwners, EntraGroupMemberships, EntraSponsors and EntraEligibleMembers have no changefeed configured and receive only weekly snapshots, not hourly updates.\n\n**Warning:** Sponsors, GroupMemberships and EligibleMembers snapshots may take up to 5 days in large tenants, or longer with throttling. This is an estimate, not a guaranteed maximum or SLA; early rows do not indicate completion.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required for the EligibleMembers table. If eligibility fails, other collectors may still be connected; verify their deployment status." + "content": "### OAuth setup\n- In the [Entra admin center](https://entra.microsoft.com), use the workspace's deployment tenant. Go to **App registrations > New registration** and register a **Single tenant** app. No redirect URI is required.\n- Copy the **Application (client) ID** from Overview. Do not use the Object ID.\n- Under **API permissions > Microsoft Graph > Application permissions** (not Delegated permissions), add the permissions below and select **Grant admin consent**.\n- Under **Certificates & secrets > Client secrets > New client secret**, create a secret and copy its **Value**, not its Secret ID. Store it securely and rotate it before expiration.\n\n**Application permissions:** `Application.Read.All`, `Device.Read.All`, `Group.Read.All`, `GroupMember.Read.All`, `OrgContact.Read.All`, `User.Read.All`, `User-LifeCycleInfo.Read.All`, `Organization.Read.All`, `RoleManagement.Read.Directory`, `RoleEligibilitySchedule.Read.Directory`, `PrivilegedEligibilitySchedule.Read.AzureADGroup`. Add `Member.Read.Hidden` for hidden memberships. PIM requires applicable licensing.\n\n**Preview:** This connector is currently in preview, and uses a Graph preview endpoint. Tables will be updated weekly for this Preview connector.\n\n**Eligibility licensing:** Microsoft Entra ID P2 or Microsoft Entra ID Governance is required for the EligibleMembers table. If eligibility fails, other collectors may still be connected; verify their deployment status." } }, { diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md index a5a63542bd7..982a30adc32 100644 --- a/Solutions/Microsoft Entra ID Assets/README.md +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -11,6 +11,9 @@ parser. Deprecation applies to the legacy connector, not to the solution. ## Set up the Graph connector +The connection requires read and write permissions on the target workspace and +the Microsoft Entra Global Administrator or Security Administrator tenant role. + 1. Install the solution in a Microsoft Sentinel-enabled Log Analytics workspace and open **Microsoft Entra ID Assets (Preview)**. 2. In the workspace's deployment tenant, register a single-tenant Microsoft Entra app. @@ -37,6 +40,8 @@ parser. Deprecation applies to the legacy connector, not to the solution. The connector supports multiple named connections. With every table selected, it uses 23 pollers: 17 weekly snapshot paths and six hourly asset changefeeds. Only pollers for the tables selected during setup are deployed. +The connector page summarizes weekly preview updates; this wording does not disable +the six existing hourly changefeeds. ### Change or stop collection diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index c9a77b25644..5dcf012dec2 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -1,6 +1,7 @@ +the legacy connector tile with migration guidance. Refine the connector description, +workspace/tenant prerequisites, configuration and preview page copy. Proposed minor version: 3.5.0. --> | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------------------------------------| From ea2299a74cf116d43d0a0f646bd564c0807a2498 Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Fri, 30 Oct 2026 13:01:58 -0400 Subject: [PATCH 6/7] Use portal-managed Preview badge and Configuration heading Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../EntraAssetsLogs_ccf/DataConnectorDefinition.json | 3 +-- .../EntraIDAssets_DataConnectorDefinition.json | 2 +- .../Data/Solution_MicrosoftEntraAssets.json | 2 +- Solutions/Microsoft Entra ID Assets/README.md | 6 +++--- Solutions/Microsoft Entra ID Assets/ReleaseNotes.md | 5 +++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json index 9f339c5395b..1815ba85fa1 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -7,7 +7,7 @@ "properties": { "connectorUiConfig": { "id": "MicrosoftEntraIDAssetsCCF", - "title": "Microsoft Entra ID Assets (Preview)", + "title": "Microsoft Entra ID Assets", "logo": "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/AADCloudSync.svg", "publisher": "Microsoft", "descriptionMarkdown": "Microsoft Entra assets include users, groups, applications, service principals and devices, together with their membership and ownership relationships. Collect this inventory in Microsoft Sentinel.", @@ -252,7 +252,6 @@ }, "instructionSteps": [ { - "title": "Configuration", "description": "Connect Entra asset data.", "instructions": [ { diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json index de5d7d6b28a..ae02bfed70a 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json @@ -3,7 +3,7 @@ "title": "[Deprecated] Microsoft Entra ID Assets", "publisher": "Microsoft", "logo": "AADCloudSync.svg", - "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Microsoft Entra ID Assets (Preview)**, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", + "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Microsoft Entra ID Assets**, marked **Preview** in the gallery, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)", "graphQueries": [], "sampleQueries": [], "dataTypes": [], diff --git a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json index 8781686d614..0d10e6dc569 100644 --- a/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json +++ b/Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json @@ -2,7 +2,7 @@ "Name": "Microsoft Entra ID Assets", "Author": "Microsoft", "Logo": "", - "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. Microsoft Entra ID Assets (Preview) ingests inventory into onboarded Entra system tables in a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes Parser for Microsoft Entra ID Assets for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).", + "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. The preview Microsoft Entra ID Assets connector ingests inventory into onboarded Entra system tables in a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes Parser for Microsoft Entra ID Assets for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).", "Data Connectors": [ "Data Connectors/EntraIDAssets_DataConnectorDefinition.json", "Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json" diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md index 982a30adc32..d0f19e75d2e 100644 --- a/Solutions/Microsoft Entra ID Assets/README.md +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -1,7 +1,7 @@ # Microsoft Entra ID Assets -This solution contains the legacy data-lake connector, **Microsoft Entra ID Assets -(Preview)** for Azure Log Analytics, and one shared schema-normalization +This solution contains the legacy data-lake connector, **Microsoft Entra ID Assets** +for Azure Log Analytics (marked Preview by the portal), and one shared schema-normalization parser. Deprecation applies to the legacy connector, not to the solution. > **Draft preview:** The new connector references the onboarded Microsoft-managed @@ -15,7 +15,7 @@ The connection requires read and write permissions on the target workspace and the Microsoft Entra Global Administrator or Security Administrator tenant role. 1. Install the solution in a Microsoft Sentinel-enabled Log Analytics workspace and - open **Microsoft Entra ID Assets (Preview)**. + open **Microsoft Entra ID Assets** with the portal's **Preview** label. 2. In the workspace's deployment tenant, register a single-tenant Microsoft Entra app. No redirect URI is required. Copy its Application (client) ID, not its Object ID. 3. Add Microsoft Graph **application** permissions and grant administrator consent: diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index 5dcf012dec2..cfb2ccbe606 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -1,7 +1,8 @@ +workspace/tenant prerequisites and preview page copy; rely on portal-managed Preview +and Configuration labels rather than duplicating them in the connector. Proposed minor version: 3.5.0. --> | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------------------------------------| From f0f9ec251ea5b38e856d8a1ddea275886dfe052e Mon Sep 17 00:00:00 2001 From: Cassidy King Date: Fri, 30 Oct 2026 14:45:15 -0400 Subject: [PATCH 7/7] Remove unsupported tenant-role prerequisite from custom Entra connector Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: fbfb2cb7-51e2-4eea-b66d-97ecf41e031c --- .../EntraAssetsLogs_ccf/DataConnectorDefinition.json | 4 ---- Solutions/Microsoft Entra ID Assets/README.md | 7 +++++-- Solutions/Microsoft Entra ID Assets/ReleaseNotes.md | 4 +++- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json index 1815ba85fa1..0c751997eee 100644 --- a/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json +++ b/Solutions/Microsoft Entra ID Assets/Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json @@ -244,10 +244,6 @@ "action": false } } - ], - "tenant": [ - "GlobalAdmin", - "SecurityAdmin" ] }, "instructionSteps": [ diff --git a/Solutions/Microsoft Entra ID Assets/README.md b/Solutions/Microsoft Entra ID Assets/README.md index d0f19e75d2e..a44c9f0dee1 100644 --- a/Solutions/Microsoft Entra ID Assets/README.md +++ b/Solutions/Microsoft Entra ID Assets/README.md @@ -11,8 +11,11 @@ parser. Deprecation applies to the legacy connector, not to the solution. ## Set up the Graph connector -The connection requires read and write permissions on the target workspace and -the Microsoft Entra Global Administrator or Security Administrator tenant role. +The connection requires read and write permissions on the target workspace. +An authorized administrator must grant consent for the application's Graph permissions. +The page retains the native workspace permission check but omits the unsupported +tenant-role prerequisite for this custom connector. This does not bypass Azure RBAC, +Graph application permissions, administrator consent, or eligibility licensing. 1. Install the solution in a Microsoft Sentinel-enabled Log Analytics workspace and open **Microsoft Entra ID Assets** with the portal's **Preview** label. diff --git a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md index cfb2ccbe606..728c114686e 100644 --- a/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md +++ b/Solutions/Microsoft Entra ID Assets/ReleaseNotes.md @@ -2,7 +2,9 @@ Microsoft Entra ID Assets connector (portal-managed Preview label) with table-selection setup and EntraAssetsNormalize parser, and deprecate the legacy connector tile with migration guidance. Refine the connector description, workspace/tenant prerequisites and preview page copy; rely on portal-managed Preview -and Configuration labels rather than duplicating them in the connector. Proposed minor version: 3.5.0. --> +and Configuration labels rather than duplicating them in the connector. Remove the +unsupported custom-connector tenant-role prerequisite; retain workspace checks and +admin-consent instructions. Proposed minor version: 3.5.0. --> | **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | |-------------|--------------------------------|---------------------------------------------------------------------------------------------------------|