LogoLogo
⌘Ctrlk
BlogSupport
  • Home
AI Assistant

I'm here to help you with the docs.

⌘Ctrli
AI Based on your context
LogoLogo
    • Navigate the Cortex XSIAM docs
    • Get started with Cortex XSIAM
    • Agentic AI in Cortex XSIAM
    • Cortex XSIAM license tiers and product licenses
    • In-product support ticket creation
    • Supported web browsers
    • Use the Cortex XSIAM interface
    • Manage API keys
    • How to onboard Cortex XSIAM
    • Plan and prepare
    • Deployment steps
    • Post-deployment
    • Configure Cortex XSIAM
    • Data management
    • Cortex XSIAM Data Sources and Connectors
      • What are Cortex XSIAM data sources and connectors?
      • What is the data source and connector catalog?
      • Vendor-specific data sources and connectors
        • 1Password
        • Abnormal Security
        • Absolute
        • abuse.ch
        • AbuseIPDB
        • Accenture
        • AdminByRequest
        • Aha
        • AIOps
        • Akamai
        • AlgoSec
        • Alibaba Cloud
        • AlienVault
        • Amazon
        • Anomali
        • Anthropic
        • Apache
        • API Security
        • APIVoid
        • Apollo.io
        • AppSentinels
        • ArcSight
        • Arista Networks
        • Arkime
        • Armis
        • Articulate Global
        • Asana
        • Atlassian
        • AttackIQ
        • Aurora Endpoint Security
        • Automox
        • BeyondTrust
        • BitSight
        • bitwarden
        • Blocklist.de
        • BloodHound Enterprise
        • BlueCat Address Manager
        • BMC
        • Box
        • Broadcom
        • BruteForceBlocker
        • Businessmap
        • C2SEC
        • CAPESandbox
        • Carbon Black
        • Celonis
        • Centreon
        • ChatGPT Enterprise
        • Check Point
        • CheckPhish
        • CipherTrust
        • CIRCL
        • CircleCI
        • Cisco
        • Citrix
        • ClickUp
        • Cloaken
        • CloudConvert
        • Cloudflare
        • Code42
        • Cohesity
        • Contentful
        • Corelight
        • Couchbase
        • CounterTack
        • Coveo
        • Cribl
        • CrowdStrike
        • CryptoCurrency
        • Cuckoo Sandbox
        • Cursor
        • CybelAngel
        • CyberArk
        • Cyber Triage
        • CYFIRMA
        • Darktrace
        • Databricks
        • DataDog
        • DeHashed
        • DHS
        • digicert
        • dnstwist
        • Docker
        • DocuSign
        • Dropbox
        • Druva
        • EasyVista
        • Email Hippo
        • Elastic
        • Endgame
        • Envoy
        • Exabeam
        • ExtraHop
        • F5
        • Fastly
        • Fidelis
        • Filigran
        • Forcepoint
        • ForeScout
        • Fortinet
        • Fortra
        • FraudWatch
        • Freshworks
        • Gainsight
        • Gamma.AI
        • Gemini Enterprise
        • Genetec
        • Generic
        • Genesys
        • Gigamon
        • GitGuardian
        • GitHub
        • GitLab
        • Giphy
        • Google
        • GraphQL
        • Grouped Example Connector
        • GRR
        • Grafana
        • Halcyon
        • Harbor
        • Harness
        • HashiCorp
        • Have I Been Pwnd
        • HCL BigFix
        • HPE Aruba
        • Hostio Solutions
        • HTTP log collector
        • IBM
        • iManage
        • Imperva
        • InfoArmor
        • Infoblox
        • Intellum
        • Intercom
        • IPInfo.io
        • IPstack
        • Ironscales
        • Ivanti
        • iZOOlogic
        • Jamf
        • JFrog
        • Joe Security
        • JumpCloud
        • JSONWhoIs.com
        • Kafka
        • Kaspersky
        • Keeper Security
        • KnowBe4
        • Koi
        • Koodous
        • Kubernetes
        • Kustomer
        • LastPass
        • Lastline
        • LevelBlue
        • LogRhythm
        • LOLBAS
        • Lookout
        • Lumu
        • Mail Utilities
        • Majestic
        • ManageEngine
        • Mattermost
        • MaxMind
        • Menlo Security
        • Meta
        • Mimecast
        • Microsoft
          • Azure DevOps
          • Azure Event Hub
          • Azure Firewall
          • Azure Network Watcher
          • Microsoft Azure
          • Microsoft Copilot Studio
          • Microsoft Defender for Endpoint Events
          • Microsoft Entra ID
          • Microsoft Office 365
          • Microsoft Office 365 (email)
          • Microsoft 365 (Posture)
          • Microsoft Teams
          • Azure Log Analytics
          • Azure Services
          • Azure WAF
          • Microsoft Active Directory
          • Microsoft Identity
          • Microsoft Intune
          • Microsoft Security Automation and Collection
          • Microsoft Windows Tools
          • M365 Automation and Collection
        • MISP
        • MITRE
        • Monday
        • MongoDB
        • MuleSoft
        • Mural
        • MxToolBox
        • NetBox
        • Netcraft
        • Netmiko
        • NetQuest
        • Netskope
        • Nintex Workflow Cloud
        • NIST
        • nmap
        • NAVEX
        • Nutanix
        • Okta
        • OneLogin
        • OpenAI
        • OpenCVE
        • OpenLDAP
        • OpenPhish
        • OpenText
        • OPSWAT
        • Oracle
        • Orca Security
        • PacketMail.net
        • PacketSled
        • PagerDuty
        • PAT Helpdesk Advanced
        • PhishLabs
        • Ping Identity
        • Pipedrive
        • Pipl
        • Plainview
        • Proofpoint
        • ProtectWise
        • Qualtrics
        • Qualys
        • Quest KACE
        • Radware
        • Rapid7
        • Razor Group
        • Recorded Future
        • Red Hat
        • Redis Labs
        • Redmine
        • ReliaQuest
        • RemoteAccess
        • Retarus
        • RSA
        • RTIR
        • runZero
        • Salesforce
        • SailPoint
        • Samhaus
        • SANS DShield
        • SAP
        • Saviynt
        • SecurityScorecard
        • Securonix
        • Sentry
        • SentinelOne
        • ServiceNow
        • Shopify
        • Shodan
        • Skyhigh Security
        • Slack
        • SMB
        • SMIME Messaging
        • Snowflake
        • SolarWinds
        • Sonatype Nexus
        • Sophos
        • Splunk
        • Sublime Security
        • Sumo Logic
        • SysAid
        • Syslog Sender
        • Tanium
        • TAXII
        • TeamViewer
        • Telegram
        • Tenable
        • Terraform
        • Thales
        • TheHive
        • Thinkst Canary
        • ThreatConnect
        • ThreatMiner.org
        • ThreatX
        • Tidy
        • TOPdesk
        • Tor Exit Adress
        • Trellix
        • TrendAI
        • Twilio
        • Uptycs
        • Vectra
        • Versa Networks
        • VMware
        • VulnDB
        • WhatsMyBrowser.org
        • Whois
        • WithSecure
        • Workday
        • X
        • YouTrack
        • Zendesk
        • Zero Networks
        • Zimperium
        • Zoom
        • Zscaler
      • Connectors
      • Standard data sources
      • Cloud service provider (CSP) onboarding
      • Generic on-premise data collectors
      • Palo Alto Networks integrations
      • Cloud Posture and Runtime Security data sources
      • External alerts using External Issue Mapping
      • Administration and troubleshooting
    • Marketplace
    • Configure the Cortex Agentic Assistant
    • Cortex MCP server
    • Automations
    • Engines
    • Remote repository management
    • Customize cases and issues
    • XQL query management
    • Multi-Tenant
    • Managed Services configuration in Cortex
    • Endpoint security
    • Endpoint DLP
    • Monitor dashboards and reports
    • Investigation and response
    • Agentic Assistant chat
    • Asset management
    • Threat management
    • Attack surface management
    • Vulnerability management
    • Exposure management
    • Cortex Advanced Email Security
    • Identity Threat Detection and Response (ITDR)
    • Rules and Policies
    • Monitor and track compliance adherence
    • Cloud Data Classification
    • Cloud Identity Security
    • Network exposure detection
    • Cortex Cloud SaaS Security
    • Cortex Cloud AI Security
    • Serverless function posture security
    • Cortex Cloud Application Security
    • Registry scanning
    • Web and API Security (WAAS)
    • Serverless function runtime security
    • Cortex Data Security
    • Cortex XSIAM XQL
    • Graph Search
    • About Cortex CLI
    • Role-Based Access Control
    • API documentation
    • Reference
    • Learn more about migrating to the latest broker VM image
    • Standalone Broker VM
    • Broker VM high availability cluster node
For the complete documentation index, see llms.txt. This page is also available as Markdown.
  1. Guides
  2. Cortex XSIAM
  3. Cortex XSIAM Documentation
  4. Configure Cortex XSIAM
  5. Cortex XSIAM Data Sources and Connectors
  6. Vendor-specific data sources and connectors

Microsoft

Configure the Microsoft data sources and connectors for Cortex XSIAM.

Here are the articles in this section:

  • Azure DevOps

  • Azure Event Hub

  • Azure Firewall

  • Azure Network Watcher

  • Microsoft Azure

  • Microsoft Copilot Studio

  • Microsoft Defender for Endpoint Events

  • Microsoft Entra ID

  • Microsoft Office 365

  • Microsoft Office 365 (email)

  • Microsoft 365 (Posture)

  • Microsoft Teams

  • Azure Log Analytics

  • Azure Services

  • Azure WAF

  • Microsoft Active Directory

  • Microsoft Identity

  • Microsoft Intune

  • Microsoft Security Automation and Collection

  • Microsoft Windows Tools

  • M365 Automation and Collection

PreviousMimecast
NextAzure DevOps

Last updated 1 day ago

Was this helpful?

LogoLogo

‍

  • Trust Center

‍

  • Privacy

‍

  • Terms of Use

‍

  • Legal

© 2026 Palo Alto Networks, Inc. All rights reserved.

Was this helpful?