Integrate Microsoft Entra ID Protection with Red Canary

The Microsoft Entra ID Protection integration enables Red Canary to ingest alerts from the Identity Protection service, complementing the standard Microsoft Entra ID and Microsoft Azure integrations that collect authentication and activity logs. While the Entra ID and Azure integrations send logs and telemetry to the Red Canary detection engine for threat analysis, the Entra ID Protection alert source specifically focuses on security signals related to user and sign-in risk. Together, these integrations enhance threat detection and event correlation across your identity infrastructure.

To ingest alerts from Entra ID Protection, you’ll need to set up the integration with Microsoft Graph. Follow the steps on Integrate Microsoft Graph with Red Canary.