Skip to main content

Microsoft

Microsoft integrations cover the identity, productivity and endpoint services most organizations depend on: Entra ID (formerly Azure AD) for authentication, Microsoft 365 for mail and collaboration, Microsoft Defender XDR for endpoint detections, Azure Event Hubs as the general-purpose pipe for Azure platform logs, and Windows Server itself. Together they answer who signed in, from where, what they did in mail and files, and what happened on the host, which is why this is usually the first category onboarded. Cloud services are collected through Microsoft's APIs or Event Hubs; Windows hosts forward their event logs through an agent as syslog.

In this section​

  • Azure Event Hubs: connecting Fluency to any Azure event hub with the Azure Event Hubs (generic) template: creating the hub and a Listen-only policy, and installing the template that reads it.
  • Microsoft 365 Activity Log: the Microsoft 365 unified audit log (Exchange, SharePoint, OneDrive, Teams and DLP activity), authorised by an administrator approving Fluency's application.
  • Microsoft 365 Bundle: the activity log, the Entra ID logs and the tenant inventory in one application, authorised by a client secret you create.
  • Microsoft 365 Inventory: a periodic snapshot of tenant users, groups, devices, app registrations and Conditional Access policies, on the Resources page (v1: SIEM → Resources).
  • Microsoft Defender XDR: Defender XDR incidents and alerts from the Graph security API, plus the device, vulnerability and posture roster from the Defender for Endpoint API on the Resources page.
  • Microsoft Entra ID Logs (Event Hubs): Entra ID sign-in and directory audit logs, streamed into an event hub by a diagnostic setting; no Entra application is added to your tenant.
  • Microsoft Entra ID Logs (Graph API): the same Entra ID logs, polled from Microsoft Graph under administrator consent, and how the two routes compare.
  • Windows Server: host-side collection: Active Directory and Sysmon guides, forwarded via NXLog.

Which Microsoft 365 template​

Four templates collect from the same Microsoft 365 tenant, and each one's name says what it collects:

Microsoft 365 Activity LogMicrosoft Entra ID Logs (Graph API)Microsoft 365 Inventory (Users, Devices, Apps)Microsoft 365 Bundle (Activity, Entra ID, Inventory)
CollectsThe unified audit log: mail, file, Teams and DLP activityEntra ID sign-ins and directory auditA periodic inventory of users, groups, devices, app registrations and Conditional Access policiesAll three
Default authenticationAdministrator consentAdministrator consentAdministrator consentClient secret only
Who finishes the setupAn administrator, in their mailboxAn administrator, in their mailboxAn administrator, in their mailboxYou

Activity Log or Entra ID Logs? The Activity Log carries only the Microsoft 365 copy of sign-ins, as the unified audit log records them. For the Entra ID sign-in and directory audit logs themselves, add Microsoft Entra ID Logs; it is identity only, and mail, file and Teams activity is in the Activity Log. Most tenants want both, or the Bundle.

Three applications or one. The Bundle installs the other three together from one app registration and a client secret, so do not install those three separately as well. Each of the three consent templates requests a different permission set, approved through a separate Entra application, and consenting to one does not consent to the others. All three can also be switched to a client secret by unticking Enable Admin Consent Mode on the install form, which reveals three hidden credential fields.

Microsoft Entra ID Logs has two routes. Graph API polls the logs under administrator consent; Event Hubs streams the same logs, plus non-interactive, service-principal and managed-identity sign-ins, through a diagnostic setting, with no Entra application. Use one or the other.

Two collection paths​

Cloud tenants (Entra ID, Microsoft 365, Defender) are collected by API or Event Hubs. Windows hosts are collected by an agent on the machine, which is a different setup entirely; see Windows Server.

Last updated on