This guide provides step-by-step instructions for obtaining API credentials (Client ID, Tenant ID, and Client Secret) from Microsoft Entra ID (formerly Azure AD) and configuring them in Logsign USO for seamless integration.
What this integration does: the Logsign Entra ID response device supports exactly two actions: disabling a user account (containment) and re-enabling it (recovery). It does not manage groups, devices, passwords, or any other Entra ID object. If you need broader Entra ID/Intune device management, see the separate Microsoft Intune Response Integration guide.
Register an Application in Microsoft Entra ID
To enable API access, you must create an application in Microsoft Entra ID and obtain the necessary credentials.
Access Microsoft Entra ID
1. Open a web browser and navigate to Microsoft Entra Admin Center.
2. Log in using a Microsoft account with administrative privileges.
3. Select Microsoft Entra ID from the left-hand navigation panel.
Register a New Application
- Go to Enterprise Applications and click + New registration.
- Enter an appropriate Name for the application (e.g., "Logsign USO Integration").
- Under Supported account types, select Singletenant.
- The Redirect URI will be configured later.
- Click Register to create the application.
Retrieve the Client ID and Tenant ID
After registration, go to the Overview page.
Copy and securely store the following:
Client ID (Application ID)
Tenant ID (Directory ID)
Configure Authentication and API Permissions
Create a Client Secret
1. Navigate to Certificates & secrets.
2. Under Client secrets, click + New client secret.
3. Provide a Description and set an expiration period.
4. Click Add.
5. Copy and securely store the Client Secret, as it cannot be retrieved once the window is closed.
Configure API Permissions
Go to API Permissions and click + Add a permission.
Select Microsoft Graph.
Use least privilege: under Application Permissions, add only User.ReadWrite.All. This is the permission Microsoft Graph requires to update a user's accountEnabled property, which is all this integration calls. Do not add Directory.ReadWrite.All, Device.ReadWrite.All, or any Delegated permissions; the integration authenticates with client-credentials (app-only) flow, so delegated permissions are never used and only widen the application's access unnecessarily.
Click Add permissions.
Click Grant admin consent to approve the requested permission.
Configure Microsoft Entra ID in Logsign USO
Once you have obtained the Client ID, Tenant ID, and Client Secret, follow these steps to configure Logsign USO:
Open Logsign USO
Log in to your Logsign USO platform.
Navigate to Settings
Go to Settings > Response.
Select Microsoft Entra ID as the provider.
Enter API Credentials
Fill in the required fields:
- Client ID → Enter the Client ID obtained from Microsoft Entra ID.
- Tenant ID → Enter the Tenant ID obtained from Microsoft Entra ID.
- Client Secret → Enter the Client Secret securely stored earlier.
There is no separate Scope field in this form; the integration always requests https://graph.microsoft.com/.default internally, which grants a token for whatever application permission was consented to above.
Available Methods
Once configured, the device exposes exactly two actions, usable from an Incident, Alarm, or Action Rule:
- disable_user (Containment) — sets the target user's account to disabled.
- enable_user (Recovery) — re-enables a previously disabled user's account.