Create a Microsoft Entra ID

Learn more about creating a Microsoft Entra ID.

To integrate Microsoft 365 services with Cortex XSIAM, you must create a Microsoft Entra ID service principal (formerly Azure AD). The service principal requires specific Microsoft Graph API permissions based on the capabilities you plan to enable.

Prerequisites

• Global Administrator access to the Microsoft Entra admin center or Azure portal.
• Access to the Microsoft 365 tenant that you want to onboard.

Task 1. Create a Service Principal

1. Sign in to the Microsoft Entra admin center or the Azure portal as a Global Administrator.
2. Navigate to App registrations > New registration.
3. Enter a descriptive name for the application, such as Cortex-Cloud-Integration.
4. For Supported account types drop down, select Single Tenant Only [Your Organisation].
5. Click Register.
6. On the Overview page, note the following values:

   • Application (client) ID
   • Directory (tenant) ID
7. Navigate to Certificates & secrets > New client secret.
8. Create a client secret.
9. Copy the Secret Value and store it.

Task 2. Configure API Permissions

Add the required Microsoft Graph application permissions based on the Cortex Cloud capabilities you plan to enable.

To add a permission:

1. In the application registration, go to API permissions.
2. Click Add a permission.
3. Select Microsoft Graph.
4. Select Application permissions.
5. Search for and select the required permissions listed in the following sections. Click on Add permissions once all the required permissions are added to the list.

Microsoft 365 Data Security

Microsoft 365 and Entra ID Identity Posture

Microsoft 365 Automation and Remediation

Microsoft Teams Data Security Permissions

Task 3. Grant Admin Consent

After adding all required API permissions:

1. On the API permissions page, click Grant admin consent for [Your Organization].
2. Confirm the consent request.
3. Verify that the status of all required permissions changes to Granted.

After completing these steps, use the Directory (tenant) ID, Application (client) ID, and Client Secret when configuring the Microsoft 365 connector in Cortex Cloud.