Microsoft Graph Security API Connector

Overview

The Microsoft Graph Security API (Graph API) Connector provides a secure endpoint to receive alerts from the Microsoft Graph Security API endpoint. Bloo can collect, normalize, and monitor alerts logs to help you identify suspicious activity within your workspace in real time.

Prerequisites

• Client ID
• Client Secret
• Tenant ID

Steps to Derive Prerequisites

Note Azure Active Directory has been rebranded to Microsoft Entra ID. If you see Microsoft Entra ID in the portal, it is the same service. The steps below remain the same.

1. Log into the Azure Active Directory Portal.

2. Select Azure Active Directory in the left menu.

   

3. Select App Registrations.

   

4. Select New Registration. Go through the registration process, providing a name for the application. Selecting Accounts in this organizational directory only is sufficient.

   

5. After the application is registered, ensure you copy the Application (client) ID and Directory (tenant) ID displayed on the Overview page. These are needed when configuring the connector.

   

6. Within the application configuration page, select Certificates & Secrets. Under Client secrets, click New client secret. In the Add a client secret pane, enter a Description and select an Expires duration, then click Add. Reference: Application Client Secret Key.

   

7. Copy the Client Secret value — you will need it when configuring the connector.

   

Warning Client secrets have an expiry date (6 months, 12 months, 24 months, or custom). When your secret expires, the connector will stop working. Generate a new secret and update the connector configuration in Bloo before it expires.

1. Request the appropriate permissions for the application. Click on API Permissions, then Add a permission and select Microsoft Graph. Find and select the following permissions:

   • SecurityAlert.Read.All
   • SecurityAlert.ReadWrite.All
   • SecurityIncident.Read.All
   • SecurityIncident.ReadWrite.All
   • Directory.Read.All
   • AuditLog.Read.All
   • SecurityEvents.Read.All

   See this list to view all available security permissions.

   

Note An Administrator must approve (grant) these permissions before the connector will function.

1. Follow the steps below to enable the Application permission role:

   • In the Manage menu, select App roles. Click the Create app role tab.
   • Display name: Enter the display name for the role.
   • Allowed member types: Select Applications as the allowed member type.
   • Value: Enter SecurityAlert.Read.All as the value.
   • Description: Enter a brief description.
   • Select the checkbox to enable the app role.
   • Click Apply.

   

Configure the Microsoft Graph Security API Connector in Bloo

All connector configuration is done from the Datasource page in Bloo.

Field	Description
Connector Name	Enter a name for the connector.
Alerts Type	Select Graph API Security alerts Type.
Client ID	Enter the Client ID.
Client Secret	Enter the Client Secret.
Tenant ID	Enter the Tenant ID.

1. Click Save after entering all the required details.

2. Bloo will validate the configuration automatically.

3. Navigate to Collection Status and confirm the connector is listed with a status of Active. This signifies the connector is configured successfully and data is ready to ingest.

Confirmed When the connector appears in Collection Status with status Active, it is configured successfully and data is ready to ingest.

Related Links

Bloo — Collection Status | Bloo — Connector Validation | Microsoft Graph Security API — Alerts | Microsoft Graph Security API — List Alerts v2 | Microsoft — Register an app | Microsoft — Security permissions | Bloo — Troubleshooting Connector Validations