Microsoft Cloud

Microsoft Cloud is SIEM (InsightIDR)‘s unified expanded cloud event source for Microsoft 365 and Azure. It connects to your Microsoft Entra ID tenant through a single app registration, then pulls data from three channels: Microsoft Graph (Defender alerts and incidents, Entra sign-ins, users and groups, risky users, Intune devices, and Advanced Hunting), the Office 365 Management Activity API (the unified audit log), and, optionally, an Azure Event Hub streaming feed (Cloud App Events and the Azure Activity Log).

When you configure your Microsoft tenant and connect it to SIEM (InsightIDR)‘s Microsoft Cloud event source, SIEM (InsightIDR) will:

• Parse Microsoft Defender alerts and incidents as third-party alert detections.
• Parse Microsoft Entra ID sign-in and directory events to offer ingress authentication, single sign-on (SSO), cloud service activity, and cloud service admin activity detections.
• Parse unified audit log events (Exchange, Entra ID, and general Microsoft 365 activity) for additional cloud service activity and ingress authentication events.
• If you enable the streaming channel, parse Cloud App Events and Azure Activity Log events for additional cloud service and admin activity visibility.

To set up Microsoft Cloud:

1. Read the requirements and complete any prerequisite steps.
2. Configure your Microsoft tenant to send data to SIEM (InsightIDR).
3. Configure SIEM (InsightIDR) to collect data from the event source.
4. Test the configuration.

Requirements

To successfully configure the Microsoft Cloud event source, you must:

• Have Global Administrator or Application Administrator access in Microsoft Entra ID, in order to create an app registration and grant API permissions.
• Have an Azure subscription with rights to create resources, if you’re enabling the streaming channel (an Event Hub namespace and a storage account).
• Have access to the Microsoft Purview compliance portal, in order to verify or enable the unified audit log.
• Collect the following values over the course of this setup, which you’ll enter into SIEM (InsightIDR) at the end:

Configure your Microsoft tenant to send data to SIEM (InsightIDR)

Complete these tasks to establish communication between SIEM (InsightIDR) and your Microsoft tenant.

Task 1: Create the Entra ID app registration

Create a single app registration in your tenant. SIEM (InsightIDR) uses this one app registration to authenticate to all three data channels.

To create the app registration:

1. Go to the Microsoft Entra admin center: https://entra.microsoft.com/ 
2. Go to App registrations, then click + New registration.
3. Enter a Name for the app (for example, SIEM InsightIDR Integration).
4. Under Supported account types, select Accounts in this organizational directory only (Single tenant).
5. Leave Redirect URI blank. This integration uses the client-credentials flow and doesn’t need one.
6. Click Register.
7. On the app’s Overview page, record the following values for later use:
   • Application (client) ID → this is your Client ID.
   • Directory (tenant) ID → this is your Tenant ID.

Task 2: Generate the client secret

To generate a client secret:

1. In the app registration, go to Manage > Certificates & secrets.
2. Select the Client secrets tab, then click + New client secret.
3. Enter a Description that identifies the secret and when it was created, for example siem-idr-2026-09, to make rotation easier to track.
4. Set Expires to a maximum of 24 months. This is Microsoft’s policy cap for client secrets.
5. Click Add.
6. Immediately copy the value in the Value column. This is your Client Secret.

Task 3: Grant API permissions

Grant the app registration the permissions it needs to read data from your tenant. All permissions must be Application permissions, not delegated permissions.

To grant API permissions:

1. In the app registration, go to API permissions, then click + Add a permission.
2. Add each permission listed below under the appropriate API, selecting Application permissions each time.
3. After adding all required permissions, click Grant admin consent for [your organization].

Required permissions

Microsoft Graph

Office 365 Management APIs

Optional permissions

Only add these permissions if you plan to use the corresponding SIEM (InsightIDR) feature.

If you plan to use response actions:

If you plan to use bidirectional alert sync:

Task 4: Create the Event Hub namespace and event hub

To create the Event Hub namespace:

1. Go to the Azure portal: https://portal.azure.com/ 
2. Go to Event Hubs, then click + Create.
3. Choose a Pricing tier appropriate for your expected data volume and number of partitions.
4. Select the same Region as your other workloads.
5. Complete the remaining namespace settings and click Review + create, then Create.
6. Once the namespace is created, go to Settings > Properties and copy the Service bus endpoint, without the trailing :443. This is your Event Hub namespace hostname (for example, contoso-onboarding.servicebus.windows.net).

To create the event hub inside the namespace:

1. In the namespace, go to Entities > Event Hubs, then click + Event hub.
2. Enter a unique name for the event hub and complete the creation steps.
3. Copy the event hub’s Name. This is your Event Hub name.

To create a consumer group:

1. Open the event hub, then go to Entities > Consumer groups, then click + Consumer group.
2. Enter a name, or use $Default only if no other consumer shares it.
3. Copy the consumer group name. This is your Consumer group value.

To grant the app registration access to the event hub:

1. In the event hub, go to Entities > Access Control (IAM), then click + Add > Add role assignment.
2. Search for and select Azure Event Hubs Data Receiver, then click Next.
3. Under Assign access to, select User, group, or service principal.
4. Under Members, click + Select members, then search for the app registration you created in Task 1.
5. Click Review + assign.

Task 5: Create the Blob Storage checkpoint container

To create the storage account:

1. In the Azure portal, go to Storage accounts, then click + Create.
2. On the Basics tab, enter a globally unique, lowercase alphanumeric Storage account name (3–24 characters), and select the same Region as your Event Hub namespace.
3. Set Performance to Standard and Redundancy to Locally-redundant storage (LRS), which is sufficient for checkpoint data.
4. On the Advanced tab, set Access tier to Hot. Checkpoints are overwritten frequently, so Hot avoids retrieval charges. Leave hierarchical namespace, SFTP, and NFS v3 off.
5. On the Networking tab, set Public network access to Enable, since SIEM (InsightIDR) reaches your storage account over the public internet.
6. On the Data protection tab, leave point-in-time restore, blob soft delete, container soft delete, blob versioning, and blob change feed off. These add cost without benefit for regenerable checkpoint data.
7. On the Security tab, require secure transfer for REST API operations, and set Minimum TLS version to 1.2.
8. Complete the remaining tabs with your organization’s standard settings, then click Review + create, then Create.
9. Once created, go to Settings > Endpoints and copy the Blob service > Primary endpoint URL, with the trailing slash removed (for example, https://contosoonboarding.blob.core.windows.net). This is your Blob Storage account URL.

To create the checkpoint container:

1. In the storage account, go to Data storage > Containers, then click + Container.
2. Enter a name (3–63 lowercase alphanumeric characters and hyphens), for example siem-idr-checkpoints.
3. Set Anonymous access level to Private (no anonymous access).
4. Click Create, then copy the container name. This is your Blob container name.

To grant the app registration access to the container:

1. Open the container, then go to Access Control (IAM).
2. Click + Add > Add role assignment, and select the Storage Blob Data Contributor role.
3. Under Members, search for the app registration you created in Task 1 (by Application ID or display name), then select it.
4. Click Review + assign, then Assign.

Allow a couple of minutes for the role assignment to propagate before testing the connection.

Task 6: Configure streaming producers

Cloud App Events, through the Defender XDR Streaming API:

1. Go to https://security.microsoft.com 
2. Go to System > Settings > Microsoft Defender XDR > Streaming API, then click + Add.
3. Enter a Name for the stream.
4. Set Sink type to Event Hub.
5. For Event Hub resource ID, enter the Resource ID of the Event Hub namespace (not the individual event hub). You can find this under the namespace’s Properties. It should look like /subscriptions/{subId}/resourceGroups/{rg}/providers/Microsoft.EventHub/namespaces/{namespace}.
6. Enter the Event Hub name you created in Task 4.
7. Under Event types, select Apps & Identities > CloudAppEvents. Microsoft Defender for Cloud Apps must be deployed and Microsoft 365 activities enabled before configuring streaming.
8. Click Save.

It can take 5–10 minutes for the first batch of events to appear.

Azure Activity Log, through diagnostic settings:

1. Go to https://portal.azure.com 
2. Go to Subscriptions, select your subscription, then go to Activity log > Export activity logs > + Add diagnostic setting.
3. Enter a Diagnostic setting name.
4. Select all available Categories.
5. Under Destination details, select Stream to an event hub.
6. Select the subscription, Event Hub namespace, and Event Hub name you created in Task 4.
7. Set Event hub policy name to RootManageSharedAccessKey (the default). Azure Monitor uses this policy to publish events; it isn’t used by SIEM (InsightIDR) to consume them.
8. Click Save.

The first events typically land within about 5 minutes of any subscription-level activity.

Task 7: Enable the unified audit log

Some Microsoft tenants have the unified audit log disabled by default. If it isn’t enabled, SIEM (InsightIDR) will connect successfully but won’t receive any Exchange, Entra ID, or general Microsoft 365 audit events.

To enable the unified audit log:

1. Go to the Microsoft Purview compliance portal: https://purview.microsoft.com 
2. Go to Solutions > Audit.
3. If you see a banner that says Start recording user and admin activity, click it.

If you don’t see this banner, auditing is already enabled and no action is needed.

Configure SIEM (InsightIDR) to collect data from the event source

Once you’ve completed the tasks above and collected the required values, you can set up the Microsoft Cloud event source in SIEM (InsightIDR).

To configure the new event source in SIEM (InsightIDR):

1. Click Data Collection in the left menu, and go to Event Sources.
2. Click Add Event Source.
3. Under the Collected By filter, select Expanded Cloud.
4. Select the Microsoft Cloud event source tile.
5. Name the event source. This name will be used to name the log that contains the event data in Log Search.
6. Click Add a New Connection.
7. Enter the values you collected earlier in their respective fields: Tenant ID, Client ID, Client Secret, and, if you enabled streaming, the Event Hub namespace hostname, Event Hub name, Consumer group, Blob Storage account URL, and Blob container name.
8. For Product Access, select All Rapid7 Products.
9. Click Save.
10. Optionally, enable Bidirectional Sync if you configured the optional alert-sync permissions in Task 3 and want SIEM (InsightIDR) to write back alert and incident status changes to Microsoft.
11. Click Save to finalize the event source configuration.

Test the configuration

To test that event data is flowing into SIEM (InsightIDR):

1. Click Data Collection in the left menu, and go to Event Sources.
2. Find the event source you created and click View raw log.
3. If the Raw Logs modal displays raw log entries, logs are successfully flowing.
4. Wait a few minutes, then open the Log Search page.
5. Select the applicable Log Sets and the Log Name that matches the event source name you chose.
6. Set the time range to Last 10 minutes, and click Run.

The Results table displays log entries received in the last 10 minutes.