Register a new application for the Logsign
These steps are needed to authenticate with the Microsoft Graph Security API.
Follow these steps to register a new application:
Sign in to the Azure Portal with your work account. Note: this stage does not require an AAD tenant admin.
- Select Microsoft Entra ID ( Azure Active Directory )
- Select App registrations
-
Select New registration
- In the new registration form that opens, enter an application name (4).
-
Select Register (5).
- Next, you'll see the overview page (6) and your app ID (7), and Directory (tenant) ID (8). Copy and save these fields. You will need them later to complete the configuration process.
-
Click on View API Permissions (9) to display the Graph permissions screen.
-
In the API Permission screen(10), click on the Add a permission button (11) and select Microsoft Graph (12).
-
Next, select Application permissions (13) in the Request API permission pane that opens.
- Under Request API permissions, select SecurityEvents.Read.All, SecurityAlert.Read.All and SecurityIncident.Read.All(14). Then click Add permissions (15).
-
This step needs to be completed by the Azure Active Directory tenant admin Login to the Azure Portal as the Azure Active Directory Tenant Administrator for your organization and navigate to App registration/API permissions screen. Click on Grant admin consent for 'the AAD tenant' (16).
-
Under Certificates & secrets (17), choose New client secret (18). A new secret will be displayed in the Value column. Copy this password – this is the only time you'll be able to. You will need it later to complete the configuration process.
Logsign Configuration
A user with admin authority must log in to Logsign, then go to Settings -> Integrations -> Data Collection -> + Device, choose API as the method and Azure Graph Security as the Provider, and fill in:
| Field | Value |
|---|---|
| Client ID | The app ID copied in step 6 above. |
| Client Secret | The client secret copied in step 12 above. |
| Tenant ID | The Directory (tenant) ID copied in step 6 above. |
| Base URL | The Microsoft Graph API base address: https://graph.microsoft.com |
| Scope | The OAuth client-credentials scope: https://graph.microsoft.com/.default. This tells Graph to issue a token for whatever application permissions were granted in step 10 above, rather than naming individual permissions here. |
Click Save. If authentication fails, re-check that admin consent (step 11) was actually granted; a missing consent is the most common cause of a token request being rejected even when the Client ID/Secret/Tenant ID are correct.