Add Microsoft Entra ID Assets (Preview) connector and parser

Solutions/Microsoft Entra ID Assets/Data Connectors/EntraIDAssets_DataConnectorDefinition.json

@@ -1,9 +1,9 @@
 {
     "id": "EntraIDAssets",
-    "title": "Microsoft Entra ID Assets",
+    "title": "[Deprecated] Microsoft Entra ID Assets",
     "publisher": "Microsoft",
     "logo": "AADCloudSync.svg",
-    "descriptionMarkdown": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)",
+    "descriptionMarkdown": "**This connector is deprecated.** The replacement, **Microsoft Entra ID Assets (Preview)**, collects asset and relationship data into your **Azure Log Analytics workspace**, shifting collection from the legacy data-lake integration to workspace-based ingestion and querying. Existing connections and historical data are not migrated automatically. Configure and validate the replacement, review affected queries and downstream dependencies, and assess Log Analytics ingestion and retention charges before disconnecting this connector. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md#migrate-from-the-legacy-connector). The replacement is preview; confirm its suitability for your use case before migrating.\n\nEntra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)",
     "graphQueries": [],
     "sampleQueries": [],
     "dataTypes": [],

Solutions/Microsoft Entra ID Assets/Data/Solution_MicrosoftEntraAssets.json

@@ -2,9 +2,13 @@
   "Name": "Microsoft Entra ID Assets",
   "Author": "Microsoft",
   "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/refs/heads/master/Logos/AADCloudSync.svg\" width=\"75px\" height=\"75px\">",
-  "Description": "Entra ID assets data connector gives richer insights into activity data by supplementing details with asset information. Data from this connector is used to build data risk graphs in Purview. If you have enabled those graphs, deactivating this Connector will prevent the graphs from being built. [Learn about the data risk graph.](https://go.microsoft.com/fwlink/?linkid=2320023)",
+  "Description": "Microsoft Entra ID Assets enriches security investigations with asset and relationship data. Microsoft Entra ID Assets (Preview) ingests inventory into onboarded Entra system tables in a Log Analytics workspace; the legacy data-lake connector is deprecated. Includes Parser for Microsoft Entra ID Assets for query-time camelCase to PascalCase alignment. Existing connections and history are not migrated automatically. The legacy connector supplies Purview data risk graphs; replacement compatibility must be confirmed before disconnecting it. See the [migration guide](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Microsoft%20Entra%20ID%20Assets/README.md).",
   "Data Connectors": [
-    "Data Connectors/EntraIDAssets_DataConnectorDefinition.json"
+    "Data Connectors/EntraIDAssets_DataConnectorDefinition.json",
+    "Data Connectors/EntraAssetsLogs_ccf/DataConnectorDefinition.json"
+  ],
+  "Parsers": [
+    "Parsers/EntraAssetsNormalize.yaml"
   ],
   "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Microsoft Entra ID Assets",
   "Version": "3.4.0",

Solutions/Microsoft Entra ID Assets/Parsers/EntraAssetsNormalize.yaml

@@ -0,0 +1,151 @@
+Function:
+  Title: Parser for Microsoft Entra ID Assets
+  Version: '1.0.0'
+  LastUpdated: '2026-10-28'
+Product: Microsoft Entra ID
+Description: |
+  Normalizes legacy camelCase and current PascalCase Entra asset and relationship data
+  to a shared PascalCase schema at query time without modifying stored data.
+  Existing PascalCase columns take precedence by column presence, including null and
+  empty values. Fields absent from the source remain empty or null.
+  Legacy data must already be queryable in the environment where the function runs.
+  This does not migrate data or reconstruct snapshot or changefeed state.
+FunctionName: EntraAssetsNormalize
+FunctionAlias: EntraAssetsNormalize
+Function Title: Parser for Microsoft Entra ID Assets
+FunctionParams:
+  - Name: T
+    Type: 'table:(*)'
+    # Used by KQL validation only; packaging omits defaults for tabular parameters.
+    Default: 'datatable(_ValidationOnly:string)[]'
+Category: Microsoft Sentinel Parser
+id: acfde93c-7e63-4877-870a-2d11e2806f37
+FunctionQuery: |
+  T
+  | project
+      AppId = tostring(column_ifexists('AppId', column_ifexists('appId', ''))),
+      CreatedDateTime = todatetime(column_ifexists('CreatedDateTime', column_ifexists('createdDateTime', datetime(null)))),
+      Description = tostring(column_ifexists('Description', column_ifexists('description', ''))),
+      DisplayName = tostring(column_ifexists('DisplayName', column_ifexists('displayName', ''))),
+      GroupMembershipClaims = tostring(column_ifexists('GroupMembershipClaims', column_ifexists('groupMembershipClaims', ''))),
+      Id = tostring(column_ifexists('Id', column_ifexists('id', ''))),
+      IdentifierUris = todynamic(column_ifexists('IdentifierUris', column_ifexists('identifierUris', dynamic(null)))),
+      IsDeviceOnlyAuthSupported = tobool(column_ifexists('IsDeviceOnlyAuthSupported', column_ifexists('isDeviceOnlyAuthSupported', bool(null)))),
+      IsFallbackPublicClient = tobool(column_ifexists('IsFallbackPublicClient', column_ifexists('isFallbackPublicClient', bool(null)))),
+      Notes = tostring(column_ifexists('Notes', column_ifexists('notes', ''))),
+      PublisherDomain = tostring(column_ifexists('PublisherDomain', column_ifexists('publisherDomain', ''))),
+      Tags = todynamic(column_ifexists('Tags', column_ifexists('tags', dynamic(null)))),
+      UniqueName = tostring(column_ifexists('UniqueName', column_ifexists('uniqueName', ''))),
+      AADTenantId = tostring(column_ifexists('AADTenantId', column_ifexists('aadTenantId', column_ifexists('tenantId', '')))),
+      DeletedDateTime = todatetime(column_ifexists('DeletedDateTime', column_ifexists('deletedDateTime', datetime(null)))),
+      TimeGenerated = todatetime(column_ifexists('TimeGenerated', column_ifexists('timeGenerated', datetime(null)))),
+      FeedType = tostring(column_ifexists('FeedType', column_ifexists('feedType', ''))),
+      FeedTypeVersion = tostring(column_ifexists('FeedTypeVersion', column_ifexists('feedTypeVersion', ''))),
+      IsAssetRemoved = tobool(column_ifexists('IsAssetRemoved', column_ifexists('isAssetRemoved', bool(null)))),
+      AccountEnabled = tobool(column_ifexists('AccountEnabled', column_ifexists('accountEnabled', bool(null)))),
+      AlternativeSecurityIds = todynamic(column_ifexists('AlternativeSecurityIds', column_ifexists('alternativeSecurityIds', dynamic(null)))),
+      ApproximateLastSignInDateTime = todatetime(column_ifexists('ApproximateLastSignInDateTime', column_ifexists('approximateLastSignInDateTime', datetime(null)))),
+      DeviceCategory = tostring(column_ifexists('DeviceCategory', column_ifexists('deviceCategory', ''))),
+      DeviceId = tostring(column_ifexists('DeviceId', column_ifexists('deviceId', ''))),
+      DeviceMetadata = tostring(column_ifexists('DeviceMetadata', column_ifexists('deviceMetadata', ''))),
+      DeviceOwnership = tostring(column_ifexists('DeviceOwnership', column_ifexists('deviceOwnership', ''))),
+      DeviceVersion = toint(column_ifexists('DeviceVersion', column_ifexists('deviceVersion', int(null)))),
+      EnrollmentProfileName = tostring(column_ifexists('EnrollmentProfileName', column_ifexists('enrollmentProfileName', ''))),
+      EnrollmentType = tostring(column_ifexists('EnrollmentType', column_ifexists('enrollmentType', ''))),
+      IsCompliant = tobool(column_ifexists('IsCompliant', column_ifexists('isCompliant', bool(null)))),
+      IsManaged = tobool(column_ifexists('IsManaged', column_ifexists('isManaged', bool(null)))),
+      IsRooted = tobool(column_ifexists('IsRooted', column_ifexists('isRooted', bool(null)))),
+      ManagementType = tostring(column_ifexists('ManagementType', column_ifexists('managementType', ''))),
+      Manufacturer = tostring(column_ifexists('Manufacturer', column_ifexists('manufacturer', ''))),
+      MdmAppId = tostring(column_ifexists('MdmAppId', column_ifexists('mdmAppId', ''))),
+      Model = tostring(column_ifexists('Model', column_ifexists('model', ''))),
+      OnPremisesLastSyncDateTime = todatetime(column_ifexists('OnPremisesLastSyncDateTime', column_ifexists('onPremisesLastSyncDateTime', datetime(null)))),
+      OnPremisesSecurityIdentifier = tostring(column_ifexists('OnPremisesSecurityIdentifier', column_ifexists('onPremisesSecurityIdentifier', ''))),
+      OnPremisesSyncEnabled = tobool(column_ifexists('OnPremisesSyncEnabled', column_ifexists('onPremisesSyncEnabled', bool(null)))),
+      OperatingSystem = tostring(column_ifexists('OperatingSystem', column_ifexists('operatingSystem', ''))),
+      OperatingSystemVersion = tostring(column_ifexists('OperatingSystemVersion', column_ifexists('operatingSystemVersion', ''))),
+      PhysicalIds = todynamic(column_ifexists('PhysicalIds', column_ifexists('physicalIds', dynamic(null)))),
+      ProfileType = tostring(column_ifexists('ProfileType', column_ifexists('profileType', ''))),
+      RegistrationDateTime = todatetime(column_ifexists('RegistrationDateTime', column_ifexists('registrationDateTime', datetime(null)))),
+      SystemLabels = todynamic(column_ifexists('SystemLabels', column_ifexists('systemLabels', dynamic(null)))),
+      TrustType = tostring(column_ifexists('TrustType', column_ifexists('trustType', ''))),
+      Classification = tostring(column_ifexists('Classification', column_ifexists('classification', ''))),
+      ExpirationDateTime = todatetime(column_ifexists('ExpirationDateTime', column_ifexists('expirationDateTime', datetime(null)))),
+      GroupTypes = todynamic(column_ifexists('GroupTypes', column_ifexists('groupTypes', dynamic(null)))),
+      IsAssignableToRole = tobool(column_ifexists('IsAssignableToRole', column_ifexists('isAssignableToRole', bool(null)))),
+      IsManagementRestricted = tobool(column_ifexists('IsManagementRestricted', column_ifexists('isManagementRestricted', bool(null)))),
+      Mail = tostring(column_ifexists('Mail', column_ifexists('mail', ''))),
+      MailEnabled = tobool(column_ifexists('MailEnabled', column_ifexists('mailEnabled', bool(null)))),
+      MailNickname = tostring(column_ifexists('MailNickname', column_ifexists('mailNickname', ''))),
+      MembershipRule = tostring(column_ifexists('MembershipRule', column_ifexists('membershipRule', ''))),
+      MembershipRuleProcessingState = tostring(column_ifexists('MembershipRuleProcessingState', column_ifexists('membershipRuleProcessingState', ''))),
+      OnPremisesDomainName = tostring(column_ifexists('OnPremisesDomainName', column_ifexists('onPremisesDomainName', ''))),
+      OnPremisesNetBiosName = tostring(column_ifexists('OnPremisesNetBiosName', column_ifexists('onPremisesNetBiosName', ''))),
+      OnPremisesSamAccountName = tostring(column_ifexists('OnPremisesSamAccountName', column_ifexists('onPremisesSamAccountName', ''))),
+      PreferredDataLocation = tostring(column_ifexists('PreferredDataLocation', column_ifexists('preferredDataLocation', ''))),
+      PreferredLanguage = tostring(column_ifexists('PreferredLanguage', column_ifexists('preferredLanguage', ''))),
+      ProxyAddresses = todynamic(column_ifexists('ProxyAddresses', column_ifexists('proxyAddresses', dynamic(null)))),
+      RenewedDateTime = todatetime(column_ifexists('RenewedDateTime', column_ifexists('renewedDateTime', datetime(null)))),
+      SecurityEnabled = tobool(column_ifexists('SecurityEnabled', column_ifexists('securityEnabled', bool(null)))),
+      Theme = tostring(column_ifexists('Theme', column_ifexists('theme', ''))),
+      Addresses = todynamic(column_ifexists('Addresses', column_ifexists('addresses', dynamic(null)))),
+      CompanyName = tostring(column_ifexists('CompanyName', column_ifexists('companyName', ''))),
+      Department = tostring(column_ifexists('Department', column_ifexists('department', ''))),
+      GivenName = tostring(column_ifexists('GivenName', column_ifexists('givenName', ''))),
+      JobTitle = tostring(column_ifexists('JobTitle', column_ifexists('jobTitle', ''))),
+      OnPremisesProvisioningErrors = todynamic(column_ifexists('OnPremisesProvisioningErrors', column_ifexists('onPremisesProvisioningErrors', dynamic(null)))),
+      Surname = tostring(column_ifexists('Surname', column_ifexists('surname', ''))),
+      Phones = todynamic(column_ifexists('Phones', column_ifexists('phones', dynamic(null)))),
+      AlternativeNames = todynamic(column_ifexists('AlternativeNames', column_ifexists('alternativeNames', dynamic(null)))),
+      ApplicationTemplateId = tostring(column_ifexists('ApplicationTemplateId', column_ifexists('applicationTemplateId', ''))),
+      AppOwnerOrganizationId = tostring(column_ifexists('AppOwnerOrganizationId', column_ifexists('appOwnerOrganizationId', ''))),
+      AppRoleAssignmentRequired = tobool(column_ifexists('AppRoleAssignmentRequired', column_ifexists('appRoleAssignmentRequired', bool(null)))),
+      Homepage = tostring(column_ifexists('Homepage', column_ifexists('homepage', ''))),
+      LoginUrl = tostring(column_ifexists('LoginUrl', column_ifexists('loginUrl', ''))),
+      NotificationEmailAddresses = todynamic(column_ifexists('NotificationEmailAddresses', column_ifexists('notificationEmailAddresses', dynamic(null)))),
+      PreferredSingleSignOnMode = tostring(column_ifexists('PreferredSingleSignOnMode', column_ifexists('preferredSingleSignOnMode', ''))),
+      PreferredTokenSigningKeyThumbprint = tostring(column_ifexists('PreferredTokenSigningKeyThumbprint', column_ifexists('preferredTokenSigningKeyThumbprint', ''))),
+      ServicePrincipalNames = todynamic(column_ifexists('ServicePrincipalNames', column_ifexists('servicePrincipalNames', dynamic(null)))),
+      ServicePrincipalType = tostring(column_ifexists('ServicePrincipalType', column_ifexists('servicePrincipalType', ''))),
+      AgeGroup = tostring(column_ifexists('AgeGroup', column_ifexists('ageGroup', ''))),
+      BusinessPhones = tostring(column_ifexists('BusinessPhones', column_ifexists('businessPhones', ''))),
+      City = tostring(column_ifexists('City', column_ifexists('city', ''))),
+      ConsentProvidedForMinor = tostring(column_ifexists('ConsentProvidedForMinor', column_ifexists('consentProvidedForMinor', ''))),
+      Country = tostring(column_ifexists('Country', column_ifexists('country', ''))),
+      CreationType = tostring(column_ifexists('CreationType', column_ifexists('creationType', ''))),
+      EmployeeHireDate = todatetime(column_ifexists('EmployeeHireDate', column_ifexists('employeeHireDate', datetime(null)))),
+      EmployeeId = tostring(column_ifexists('EmployeeId', column_ifexists('employeeId', ''))),
+      EmployeeLeaveDateTime = todatetime(column_ifexists('EmployeeLeaveDateTime', column_ifexists('employeeLeaveDateTime', datetime(null)))),
+      EmployeeType = tostring(column_ifexists('EmployeeType', column_ifexists('employeeType', ''))),
+      ExternalUserState = tostring(column_ifexists('ExternalUserState', column_ifexists('externalUserState', ''))),
+      ExternalUserStateChangeDateTime = todatetime(column_ifexists('ExternalUserStateChangeDateTime', column_ifexists('externalUserStateChangeDateTime', datetime(null)))),
+      FaxNumber = tostring(column_ifexists('FaxNumber', column_ifexists('faxNumber', ''))),
+      IsResourceAccount = tobool(column_ifexists('IsResourceAccount', column_ifexists('isResourceAccount', bool(null)))),
+      LastPasswordChangeDateTime = todatetime(column_ifexists('LastPasswordChangeDateTime', column_ifexists('lastPasswordChangeDateTime', datetime(null)))),
+      LegalAgeGroupClassification = tostring(column_ifexists('LegalAgeGroupClassification', column_ifexists('legalAgeGroupClassification', ''))),
+      MobilePhone = tostring(column_ifexists('MobilePhone', column_ifexists('mobilePhone', ''))),
+      OfficeLocation = tostring(column_ifexists('OfficeLocation', column_ifexists('officeLocation', ''))),
+      OnPremisesDistinguishedName = tostring(column_ifexists('OnPremisesDistinguishedName', column_ifexists('onPremisesDistinguishedName', ''))),
+      OnPremisesImmutableId = tostring(column_ifexists('OnPremisesImmutableId', column_ifexists('onPremisesImmutableId', ''))),
+      OnPremisesUserPrincipalName = tostring(column_ifexists('OnPremisesUserPrincipalName', column_ifexists('onPremisesUserPrincipalName', ''))),
+      OtherMails = todynamic(column_ifexists('OtherMails', column_ifexists('otherMails', dynamic(null)))),
+      PasswordPolicies = tostring(column_ifexists('PasswordPolicies', column_ifexists('passwordPolicies', ''))),
+      PostalCode = tostring(column_ifexists('PostalCode', column_ifexists('postalCode', ''))),
+      ShowInAddressList = tobool(column_ifexists('ShowInAddressList', column_ifexists('showInAddressList', bool(null)))),
+      SignInSessionsValidFromDateTime = todatetime(column_ifexists('SignInSessionsValidFromDateTime', column_ifexists('signInSessionsValidFromDateTime', datetime(null)))),
+      State = tostring(column_ifexists('State', column_ifexists('state', ''))),
+      StreetAddress = tostring(column_ifexists('StreetAddress', column_ifexists('streetAddress', ''))),
+      UsageLocation = tostring(column_ifexists('UsageLocation', column_ifexists('usageLocation', ''))),
+      UserPrincipalName = tostring(column_ifexists('UserPrincipalName', column_ifexists('userPrincipalName', ''))),
+      UserType = tostring(column_ifexists('UserType', column_ifexists('userType', ''))),
+      CountryLetterCode = tostring(column_ifexists('CountryLetterCode', column_ifexists('countryLetterCode', ''))),
+      DefaultUsageLocation = tostring(column_ifexists('DefaultUsageLocation', column_ifexists('defaultUsageLocation', ''))),
+      MarketingNotificationEmails = todynamic(column_ifexists('MarketingNotificationEmails', column_ifexists('marketingNotificationEmails', dynamic(null)))),
+      PartnerTenantType = tostring(column_ifexists('PartnerTenantType', column_ifexists('partnerTenantType', ''))),
+      SecurityComplianceNotificationMails = todynamic(column_ifexists('SecurityComplianceNotificationMails', column_ifexists('securityComplianceNotificationMails', dynamic(null)))),
+      Street = tostring(column_ifexists('Street', column_ifexists('street', ''))),
+      TechnicalNotificationMails = todynamic(column_ifexists('TechnicalNotificationMails', column_ifexists('technicalNotificationMails', dynamic(null)))),
+      SourceId = tostring(column_ifexists('SourceId', column_ifexists('sourceId', ''))),
+      TargetId = tostring(column_ifexists('TargetId', column_ifexists('targetId', ''))),
+      SourceType = tostring(column_ifexists('SourceType', column_ifexists('sourceType', ''))),
+      TargetType = tostring(column_ifexists('TargetType', column_ifexists('targetType', '')))