Overview

The Azure Active Directory (Microsoft Entra ID) integration ingests:

• Interactive and non-interactive sign-in logs
• Directory audit logs (user, group, application, role changes)
• Risk detections and conditional access evaluations
• Service principal sign-ins

Logs are read from the Microsoft Graph reporting API.

Prerequisites

• An Azure AD tenant with Global Administrator or Application Administrator rights to register apps and grant API permissions.
• An Azure AD Premium P1 or P2 license — required to expose sign-in logs via the Graph API.

Step 1: Register an app in Azure AD

1. Sign in to the Azure portal and open Microsoft Entra ID.
2. Go to App registrations → New registration.
3. Name it atatus-siem, choose Accounts in this organizational directory only, and click Register.
4. From the app's Overview page, copy the Application (client) ID and Directory (tenant) ID.
5. Open Certificates & secrets → Client secrets → New client secret. Copy the secret Value immediately.
6. Open API permissions → Add a permission → Microsoft Graph → Application permissions and add:
   • AuditLog.Read.All
   • Directory.Read.All
7. Click Grant admin consent for .

Step 2: Connect Azure AD in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the Azure Active Directory card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The Azure AD card shows Configured.
• Sign-in and audit events appear in Security → Cloud SIEM → Audit Logs → Events with source azure_ad.