---
title: "Integrate Microsoft Graph with Red Canary"
slug: "integrate-microsoft-graph-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-microsoft-graph-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Microsoft Graph with Zscaler MDR

> [!NOTE]
> **Note:** Zscaler MDR is now Zscaler MDR. Please bear with us while we update the naming in our third-party integrations.

The Microsoft Graph integration allows Zscaler MDR to ingest security alert data from multiple Microsoft security sources. The integration leverages the the [Microsoft Graph Security API endpoint](https://learn.microsoft.com/en-us/graph/security-concept-overview) to collect and process aggregated alert data from the following services:

- Microsoft Defender for Cloud Apps
- Microsoft Defender for Endpoint
- Microsoft Defender for Identity
- Microsoft Defender for Office 365
- Microsoft Defender XDR
- Microsoft Entra ID Protection

Once you activate the integration, you can view alerts and manage how data is ingested, all from one place. Follow the steps below to get started.

## Prerequisites

Before you start the Microsoft Graph integration, please make sure the following requirements are met:

- You have one of the following subscription packages:
  - MDR Complete (Cloud)
  - MDR Complete (Endpoint)
  - MDR Complete (Identity)
  - MDR Enterprise (Cloud)
  - MDR Enterprise (Endpoint)
  - MDR Enterprise (Identity)
- You’re a Global Admin user
- You have an active Microsoft subscription that includes the Defender XDR data sources you select in [Step 3](/doc/docs/integrate-microsoft-graph-with-red-canary#3-red-canary-configure-red-canary-to-retrieve-data). To check if your subscription plan includes your desired data sources, refer to [Microsoft's Subscription Matrix](https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/bade/documents/products-and-services/en-us/education/Modern-Work-Plan-Comparison-Enterprise-15.pdf).
- You consent to our [Permission Requirements for Microsoft](/doc/docs/permission-requirements-for-microsoft)

## 1 Zscaler MDR | Add the Integration

> [!NOTE]
> **Note:** In the steps below, “v2” is a Zscaler MDR reference, distinguishing our newer integration from a legacy version. It is not a reference to any Microsoft product versioning.

1. In the Zscaler MDR portal, go to the **Integrations** page, then click **Add Integration**.
2. On the **Add integration** dialog, search for **Microsoft Graph**, then click **Configure**.![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-1_02.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
3. On the **Add Integration** page, enter a name for the integration. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-1-03.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)

## 2 Zscaler MDR | Choose How Zscaler MDR Will Receive Data

1. In the **Choose how Zscaler MDR will receive this data** section, select **Microsoft Graph V2 via API Poll** from the **Ingest Format / Method** dropdown. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-2_01.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
2. Click **Next**.

## 3 Zscaler MDR | Configure Zscaler MDR to Retrieve Data

1. In the **Configure Zscaler MDR to retrieve data from this integration** section:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-3_01.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
  - In the **Acknowledge integrations** section, uncheck any Microsoft sources from which you don’t want to ingest data.
  - In the **Microsoft Tenant ID** field, enter your tenant ID.
2. In the **Permissions** section, click **this consent link**, which opens a permissions requested screen. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-3_02.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
3. Click **Accept** to approve the permissions. Learn more about [Microsoft Graph API permissions](/doc/docs/understand-permissions-requirements#microsoft-graph-api-permissions).

> [!NOTE]
> Note
> 
> Only Global Administrators can approve admin consent requests.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-3_03.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
4. Return to Zscaler MDR and check the **Confirm Microsoft Graph v2 API Access Granted** box. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-3_04.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
5. Click **Next**.

## 4 Zscaler MDR | Customize How Data is Handled

1. (Optional) In the **Customize how data from this integration is handled** section, you can enable **Process Correlation** if appropriate.

> [!NOTE]
> **What is Process Correlation?**
> 
> If a third-party alert platform lets you create your own rules to trigger alerts, Zscaler MDR can correlate with the rule metadata when it displays the alerts in the timeline. To conserve API bandwidth and compute cycles, process correlation for user-defined alerts is disabled by default.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-4_01(1).png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)
2. (Optional) In the **Actions in the Source Platform** section, you can disable or enable alert actions to control how Zscaler MDR engages with alerts. ![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-4_02.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D) These settings manage how Zscaler MDR engages with alerts. The table below describes the outcome of each setting when enabled.

| **Setting** | **Default** **State** | **Outcome** |
| --- | --- | --- |
| **As Red** **Cana****ry validates the alert** | Enabled | When enabled, Zscaler MDR adds comments to the alert notifying users of the current investigation status as the alert is investigated and resolved. |
| **When Zscaler MDR validates the alert as non-threatening** | Enabled | When enabled, Zscaler MDR resolves the alert as `Informational` if the state is Not a Threat. |
| **When Zscaler MDR validates the alert as suspicious** | Disabled | When enabled, Zscaler MDR resolves the alert as `True Positive` if the state is `Suspicious`, `Highly Suspicious`, or `Threat` but no threat has been published. |
| **When Zscaler MDR publishes a threat involving the alert** | Enabled | When enabled, Zscaler MDR resolves the alert as `True Positive` if the state is `Threat` and a threat has been published. |

## 5 Zscaler MDR | Activate the Integration

After you’ve completed the configuration, click **Save** to activate the integration.

> [!TIP]
> **The integration is now live!**
> 
> You should see Microsoft security alerts start appearing in Zscaler MDR within one hour.

For more information on how to trigger a test for the integration after it's been configured, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-detection-test?view=o365-worldwide).

Once the integration is activated, you’ll see the alert sources you selected during setup. The "parent" integration (Graph) gathers and processes alerts from all sources, automatically assigning each one to its original Microsoft service, like Defender for Endpoint or Defender for Office 365. This is why each service appears as a distinct "child" alert source. The **Integrations** page lists all of these "child" sources, allowing you to view their data. However, configuration is managed at the "parent" level through Microsoft Graph.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/microsoftgraph-5_02.png?sv=2026-02-06&spr=https&st=2026-11-01T15%3A46%3A15Z&se=2026-11-01T16%3A46%3A15Z&sr=c&sp=r&sig=7ron21xYbiahua58R5U5kervaU19vE2hV6q3oXHuHjQ%3D)

> [!NOTE]
> **Note**
> 
> If you want to remove the integration, we recommend deactivating rather than deleting it to retain its historical data.
> 
> If you want to remove a specific data source, such as Defender for Endpoint, go to the Graph integration, uncheck the source, and click Save. This will deactivate further data ingestion but will preserve historical data.