Integrate Microsoft Entra ID with Red Canary

• You must be subscribed to Red Canary's MDR Identities license

• You must have Azure Global Admin rights

• Access to an Azure Tenant ID

• Access to an Azure Log Analytics Workspace Resource ID

Note: Since these logs are available in their native form only through a Log Analytics Workspace, users should expect costs to increase on their Azure bill for storing the data briefly in the workspace itself, and egressing it to Red Canary. We've been selective about the tables we ask customers to export to keep these costs as low as possible.

For Red Canary to start receiving your telemetry, you must send your data from your environment to an Azure Log Analytics workspace.

Set up your Log Analytics workspace

1. From your Red Canary homepage, click Integrations.

   

2. From the Integrations section, locate and then click Microsoft Entra ID.

   

3. Enter a name for your new Microsoft Entra ID integration.

4. Select I need to set up a Log Analytics workspace.

Note: If you already have a Log Analytics workspace ingesting logs, including ADFSSignInLogs, AuditLogs, ManagedIdentitySignInLogs, ServicePrincipalRiskEvents, ServicePrincipalSignInLogs, SignInLogs, and UserRiskEvents, select I already have a Log Analytics workspace set up and continue to Step 1.22.

Microsoft Azure

5. From your Microsoft Azure homepage, in the search bar, type and then select Resource groups.

Note: Your account must have write permissions to create a Resource Group and Log Analytics workspace in the desired Subscription.

6. Click +Create.

7. From the Subscription dropdown, select the Subscription you would like to house your Azure Log Analytics workspace.

8. Enter a Resource Group name. (Example: Red_Canary_Resources)

9. From the Region dropdown, select your local region.

10. Click Next: Tags >.

11. Click Next: Review + create >.

12. Click Create.

13. In the search bar, type and then select Log Analytics workspaces.

    

14. Click +Create.

15. From the Subscription dropdown, select the Subscription associated with the Resource Group created in Step 1.8.

16. From the Resource group dropdown, select the Resource Group.

17. Enter a name for the Instance details. (Example: Red_Canary_Log_Analytic_workspace)

18. From the Region dropdown, select eastus.

19. Click Next: Tags >.

20. Click Next: Review + create >.

21. Click Create.

Red Canary

22. Select I’ve completed creating the Log Analytics workspace.

    

Set up your Log Analytics workspace to collect Entra ID logs

23. Select I need to configure my Log Analytics workspace to collect Entra ID logs.

Note: If you already have a Log Analytics workspace to collect the required Entra ID logs, select I already have my Log Analytics workspace set up to collect Entra ID logs, and then click Next to continue on to Step 1.34.

Microsoft Entra

24. Sign-in to the Microsoft Entra Admin Center as a Security Administrator.

25. Click Identity.

26. Click the Monitoring & health dropdown.

27. Click Diagnostic settings.

28. Click +Add diagnostic setting.

    

29. From the Diagnostic setting page, perform the following steps:

    1. From the Category details section, select the following:

       1. ADFSSignInLogs

       2. AuditLogs

       3. ManagedIdentitySignInLogs

       4. ServicePrincipalRiskEvents

       5. ServicePrincipalSignInLogs

       6. SignInLogs

       7. UserRiskEvents

30. From the Destination details section, select Send to Log Analytics workspace.

31. From the subscription dropdown, select your Subscription.

32. From the Log Analytics workspace dropdown, select your Log Analytics workspace.

33. Click Save.

Red Canary

34. Select I’ve completed configuring my Log Analytics workspace to collect Entra ID logs.

    

35. Click Next.

You’ll need to download the Azure Lighthouse offer template, which contains the definition of our Azure Lighthouse Managed Service Provider offer. The offer defines a set of RBAC Role Assignments granting permissions to Red Canary in your environment required for this Integration. To utilize the offer, you will log in to your Azure Portal and add the offer to the Azure Lighthouse service to apply the permissions granted in your environment.

Install the Azure Lighthouse Managed Service Provider Offer

1. To download the Azure Lighthouse offer template, click Download. You’ll use this in a later step.
   

   

Microsoft Azure

2. From your Microsoft Azure homepage, in the search bar, type and then select Azure Lighthouse.

Note: Your account must have Global administrator permissions to deploy the Offer Template in your Subscription.

3. Click View service provider offers.

   

4. From the navigation pane, click Service provider offers.

   

5. Click the +Add offer dropdown.

   

6. Click Add via template.

   

7. Click Browse for files.

   

8. To upload the RedCanaryEntraIntegration.json file you downloaded in Step 2.1, click Upload.

   

9. Click Review + Create.

Note: The Subscription you selected must be where the Log Analytics workspace is located.

10. Click Create.

Red Canary

11. Select I’ve installed the offer template.

    

Install the Red Canary Enterprise Application

The Enterprise Application enables Red Canary to understand your MDR Identities license usage by counting the identities of Microsoft Entra ID users and applications. Performing this step requires a user account with Global Administrator permissions and the enablement of the admin consent workflow for your Microsoft Entra ID service.

12. Click the consent link and then select your Microsoft Account.

    

Microsoft Azure

13. Provide an approval reason and then click Request approval.

    Note: If the Account selected has Global Administrator rights, click Accept.

14. Navigate to the Admin consent requests area and then click Red Canary + Entra ID Log Ingest.

15. Click Review permissions and consent.

16. Select an admin account and then click Accept.

    

Red Canary

17. Select I’ve granted consent to Red Canary.

    

18. Click Next.

You’ll need to input your Azure Tenant ID (unique identifier for their Azure environment) and a Resource ID (unique identifier of their selected Log Analytics workspace) into Red Canary. We use these identifiers to manage your Log Analytics workspace. You must sign in to your Azure Portal to retrieve this information.

Record your Azure Tenant ID

1. Enter your Azure Tenant ID.

Note: Click Overview to review the details of your Azure Tenant, including the Tenant ID.

Microsoft Azure

2. From your Microsoft Azure homepage, in the search bar, type and then select Log Analytics workspaces.

   

3. Select the Log Analytics workspace that was created in Step 1.14.

4. From the navigation menu, select Properties.

   

5. Copy and then save the Resource ID of the workspace.

   

Record the Resource ID for the Log Analytics workspace collecting Entra ID logs

Red Canary

6. Enter the Log Analytics Resource ID from the previous step.

   

7. Click Save.

   Note: Once saved, Red Canary will begin provisioning the resources required for the Integration. During this time, the status of the Integration will be shown as Provisioning. It will update to Active when provisioning has been completed.

Follow the steps in Response Actions for Entra ID to enable automated playbooks, configured in Red Canary, to take action in Entra ID.  to

Integration Architecture

The Microsoft Entra ID Integration supports connecting Red Canary with a customer’s Microsoft Entra ID environment at the Tenant level.

The integration specifically focuses on Microsoft Entra ID, which is responsible for generating and managing Identity & Access Management (IAM) logs. These logs are transferred from a customer’s Microsoft Entra ID environment to Red Canary using a combination of Azure services. Below is an outline of the log collection and ingestion process:

• Diagnostic Settings: Customers configure Diagnostic Settings in Microsoft Entra ID to collect relevant logs in an Azure Log Analytics Workspace.

• Data Export: Red Canary automates the creation of Data Export settings to send collected logs from the Log Analytics Workspace to an Azure Event Hub.

• Ingestion: The Event Hub queues and prepares the logs for downstream ingestion and analysis by Red Canary.

Lighthouse Requirement

Azure Lighthouse, a service for cross-tenant management, is required for this integration to function correctly. Customers should refer to the integration documentation above for more details on setting up Azure Lighthouse.

Entra ID Licensing and Associated Azure Costs

This integration is available to all customers with any level of Entra ID licensing. However, customers should be aware of potential Azure costs associated with storing logs in a Log Analytics Workspace and exporting them to Red Canary. Red Canary has minimized the number of tables exported to control these costs.

• Log Analytics Data Ingestion: Charges incurred for storing logs in a Log Analytics Workspace.

• Log Analytics Data Export: Costs associated with transferring logs from the workspace to Red Canary via the Event Hub.

For more information, refer to:

• Azure Monitor Pricing

• Log Analytics Data Size Calculation

Comparison of Entra ID Integrations

Red Canary offers multiple integrations related to Microsoft Entra ID. Here is a summary of the key differences:

• Entra ID: The telemetry integration described in this article, which ingests and analyzes raw log data.

• Entra ID Alerts: An older legacy integration, generally not recommended as it lacks modern parsing and detection capabilities.

• Entra ID Identity Protection v2: A supported alert source from the Microsoft XDR Defender suite that correlates identity-related alerts with telemetry from other integrations, we recommend configuring this integration if it is included in your Microsoft licensing.

• Entra ID Response Actions: A response integration configured through the Red Canary Automate interface, enabling automated actions targeting Entra ID identities.

• Microsoft Office 365: A separate integration that collects Office 365 audit logs. We recommend configuring the Microsoft Office 365 integration in addition to the Entra ID integration, as both collect different and important types of data.

What Data Are We Collecting?

By analyzing this data, Red Canary identifies potential security threats and anomalous behavior, enabling timely response and protection against malicious actors.