Page Comparison

Table of Contents

maxLevel	2
type	flat

...

Note
You need the Admin level permissions on the Azure portal as the subscription setup will require admin consent API permissions, authentications, and audits.

Action

Steps

1

Register and configure the application

Go to Azure portal and click on Azure Active Directory.
Click on App registration on the left-menu side. Then click on + New registration.
On the Register and Application page:
1. Name the application.
2. Select Accounts in any organizational directory (Any Azure AD directory - Multitenant) and personal Microsoft accounts (e.g. Skype, Xbox) in Supported Accounts type.
3. In Redirect URI (optional) leave it as default (blank).
4. Click Register.
App registration page will open. Click on your app to configure it and give it permissions. You will see your app’s dashboard with information (docs, endpoints, etc.) when clicking it.
Click Authentication on the left-menu side, then choose + Add a platform and select Mobile and desktop application.
Select the three redirects URIs:
- https://login.microsoftonline.com/common/oauth2/nativeclient
- https://login.live.com/oauth20_desktop.srf
- msale36f3a02-3eef-437b-874e-8a0aa29a2bf0://auth
Click Configure.

2

Grant the required permissions

Go to API permissions on the left-menu side.
Click + Add permission in case you don’t have Microsoft Graph in the API/Permission list.
Select Application permissions and search for Security. Check check SecurityEvents.Read.All.
Repeat the same step 3 for Check the following permissions: AuditLog.Read.All,Directory.Read.All and User.Read.All. If you did everything correctly, permissions will display.
Select Grant admin consent for the applications.

Info
You do not need to activate permissions if you are not going to use its corresponding resource. Check the Permissions reference per service section for a detailed breakdown on resource and their needed permissions.

3

Obtain the requires credentials for the collector

Go to Certificates & Secrets, select + New client secret . Named it and copy the token value.
Go to Overview to get your Tenant ID and Client ID and copy both values.

Note
The token will display only once. You will need to create another one if you didn’t copy it the first time.

...

Collector service	Resource	Required permissions	Microsoft documentation
`alerts`	alerts	`SecurityEvents.Read.All`	List alerts
`alerts_v2`	alerts_v2	`SecurityAlert.Read.All, SecurityIncidents.Read.All, and SecurityActions.Read.All`	List alerts_v2
`secure_scores`	secureScores	`SecurityEvents.Read.All`	List secureScores
`secure_score_control_profiles`	secureScoreControlProfiles	`SecurityEvents.Read.All`	List secureScoreControlProfiles
`audit`	directoryAudits	`AuditLog.Read.All and Directory.Read.All`	List directoryAudits
`provisioning`	provisioningObjectSummary	`AuditLog.Read.All and Directory.Read.All`	List provisioningObjectSummary
`signIn`	signIns	`AuditLog.Read.All and Directory.Read.All`	List signIns
Required for all services	authentication	`User.Read`	Microsoft Graph permissions

...

Versions Compared