Register a new application for the Logsign
These steps are needed to authenticate with the Microsoft Graph Security API.
Logsign collects alerts from the Microsoft Graph /v1.0/security/alerts_v2 endpoint. Microsoft retired the legacy /v1.0/security/alerts endpoint on October 15, 2026, and it no longer returns usable alert data. If your Logsign version still polls the legacy endpoint, the source log shows "status code: 206" and no new alerts arrive. Contact Logsign Support to confirm that your version includes the alerts_v2 update.
Follow these steps to register a new application:
Sign in to the Azure Portal with your work account. Note: this stage does not require an AAD tenant admin.
- Select Microsoft Entra ID ( Azure Active Directory )
- Select App registrations
-
Select New registration
- In the new registration form that opens, enter an application name (4).
-
Select Register (5).
- Next, you'll see the overview page (6) and your app ID (7), and Directory (tenant) ID (8). Copy and save these fields. You will need them later to complete the configuration process.
-
Click on View API Permissions (9) to display the Graph permissions screen.
-
In the API Permission screen(10), click on the Add a permission button (11) and select Microsoft Graph (12).
-
Next, select Application permissions (13) in the Request API permission pane that opens.
-
Under Request API permissions, select SecurityAlert.Read.All (14). Then click Add permissions (15). SecurityAlert.Read.All is the only permission the poller needs, because it reads alerts from
/security/alerts_v2. SecurityEvents.Read.All only applied to the retired legacy alerts endpoint, and the poller no longer uses it. The poller does not read incidents either, so SecurityIncident.Read.All is not required. If the app already has these two permissions from an earlier setup, they do no harm, but you can remove them to keep the grant minimal. -
This step needs to be completed by the Azure Active Directory tenant admin Login to the Azure Portal as the Azure Active Directory Tenant Administrator for your organization and navigate to App registration/API permissions screen. Click on Grant admin consent for 'the AAD tenant' (16).
-
Under Certificates & secrets (17), choose New client secret (18). A new secret will be displayed in the Value column. Copy this password – this is the only time you'll be able to. You will need it later to complete the configuration process.
Logsign Configuration
A user with admin authority must log in to Logsign, then go to Settings -> Integrations -> Data Collection -> + Device, choose API as the method and Azure Graph Security as the Provider, and fill in:
| Field | Value |
|---|---|
| Client ID | The app ID copied in step 6 above. |
| Client Secret | The client secret copied in step 12 above. |
| Tenant ID | The Directory (tenant) ID copied in step 6 above. |
| Base URL | The Microsoft Graph API base address: https://graph.microsoft.com |
| Scope | The OAuth client-credentials scope: https://graph.microsoft.com/.default. This tells Graph to issue a token for whatever application permissions were granted in step 10 above, rather than naming individual permissions here. |
Click Save. If authentication fails, re-check that admin consent (step 11) was actually granted; a missing consent is the most common cause of a token request being rejected even when the Client ID/Secret/Tenant ID are correct.
Enter the Base URL without the /v1.0 suffix and without a trailing slash. The poller adds /v1.0/security/alerts_v2 to it.
How alerts are collected
The poller requests alerts in ascending createdDateTime order, up to 1000 alerts per page and up to 10 pages per run. It saves the newest createdDateTime it has processed and continues from that point on the next run, so a backlog is collected over several runs. By default, a new source starts 12 hours before the current UTC time, so the first run collects the alerts of the last 12 hours.
Troubleshooting
| Symptom / Code | Likely Cause | What to Check |
|---|---|---|
| "status code: 206" in the source log and no new alerts since October 15, 2026 | The installed poller still calls the retired legacy /security/alerts endpoint. |
Contact Logsign Support to update the Azure Graph Security poller to the alerts_v2 version. The updated poller treats a 206 Partial Content answer from alerts_v2 as a successful response. |
| 401 Unauthorized | Wrong Tenant ID, Client ID, or Client Secret, or the client secret has expired. | The poller requests a new token once and retries. If the error stays, re-copy the IDs from the app overview page and check the secret's expiration date under Certificates & secrets. |
| 403 Forbidden, with a log message that the endpoint "needs the SecurityAlert.Read.All application permission with admin consent" | The token is valid, but the app does not have SecurityAlert.Read.All, or admin consent was not granted. | In Azure, open API permissions on the app and confirm that SecurityAlert.Read.All is an Application permission with status "Granted". Grant admin consent again if needed. |
| "There are no new events." | No alerts were created in the tenant since the last saved position. | This is normal when the tenant has no new alerts. Confirm in the Microsoft Defender portal that new alerts exist for the period. |