This integration retrieves users and devices, with group memberships fromMicrosoft Entra ID(formerly Azure Active Directory).

This module has been tested against theMicrosoft Graph REST API v1.0.

The Microsoft Entra ID Entity Analytics integration collects two types of data: user and device. While configuring the integration, you can use theDataset dropdown option to select which type of data you want to collect from Microsoft Entra ID.

Elastic Agent must be installed. For more details, check the Elastic Agentinstallation instructions.

The following Azure API permissions are required:

If you want to collect device properties that are managed by Microsoft Intune, the following additional permission is required:

Without this permission, the following device fields will returnnull values even if the devices are enrolled in Intune:

• entityanalytics_entra_id.device.is_compliant
• entityanalytics_entra_id.device.is_managed
• entityanalytics_entra_id.device.compliance_expiration_date_time
• entityanalytics_entra_id.device.category
• entityanalytics_entra_id.device.ownership
• entityanalytics_entra_id.device.enrollment_profile_name
• entityanalytics_entra_id.device.mdm_app_id

For more details on how to set up the necessary App Registration, permission granting, and secret configuration, refer to thisguide.

1. In Kibana navigate toManagement >Integrations.
2. In the search bar, typeMicrosoft Entra ID Entity Analytics.
3. Select theMicrosoft Entra ID Entity Analytics integration and add it.
4. While adding the integration, add the Tenant ID, Client (Application) ID and Secret (API Key) that you obtained earlier.
5. Save the integration.

The integration periodically contacts Microsoft Entra ID using the Graph API, retrieving updates for users, devices and groups, updates its internal cache of user and device metadata and group membership information, and ships updated user metadata to Elasticsearch.

Fetching and shipping updates occurs in one of two processes:full synchronizations andincremental updates. Full synchronizations will send the entire list of users and devices in state, along with write markers to indicate the start and end of the synchronization event. Incremental updates will only send data for changed users and devices during that event. Changes on a user or device can come in many forms, whether it be a change to the user or device metadata, a user/device was added or deleted, or group membership was changed (either direct or transitive). By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case.

A user document:

{  "@timestamp": "2022-11-04T09:57:19.786056-05:00",  "event": {    "action": "user-discovered"  },  "azure_ad": {    "userPrincipalName": "example.user@example.com",    "mail": "example.user@example.com",    "displayName": "Example User",    "givenName": "Example",    "surname": "User",    "jobTitle": "Software Engineer",    "mobilePhone": "123-555-1000",    "businessPhones": [      "123-555-0122"    ]  },  "user": {    "id": "5ebc6a0f-05b7-4f42-9c8a-682bbc75d0fc",    "group": [      {        "id": "331676df-b8fd-4492-82ed-02b927f8dd80",        "name": "group1"      },      {        "id": "d140978f-d641-4f01-802f-4ecc1acf8935",        "name": "group2"      }    ]  },  "labels": {    "identity_source": "azure-1"  }}

A device document:

{  "@timestamp": "2022-11-04T09:57:19.786056-05:00",  "event": {    "action": "device-discovered"  },  "azure_ad": {    "accountEnabled": true,    "displayName": "DESKTOP-LETW452G",    "operatingSystem": "Windows",    "operatingSystemVersion": "10.0.19043.1337",    "physicalIds": {      "extensionAttributes": {        "extensionAttribute1": "BYOD-Device"      }    },    "alternativeSecurityIds": [      {        "type": 2,        "identityProvider": null,        "key": "DGFSGHSGGTH345A...35DSFH0A"      }    ]  },  "device": {    "id": "2fbbb8f9-ff67-4a21-b867-a344d18a4198",    "group": [      {        "id": "331676df-b8fd-4492-82ed-02b927f8dd80",        "name": "group1"      }    ]  },  "labels": {    "identity_source": "azure-1"  }}

Full synchronizations will be bounded on either side by "write marker" documents.

{  "@timestamp": "2022-11-04T09:57:19.786056-05:00",  "event": {    "action": "started",    "start": "2022-11-04T09:57:19.786056-05:00"  },  "labels": {    "identity_source": "azure-1"  }}

This is theEntity dataset.

{    "@timestamp": "2025-04-01T18:07:36.482Z",    "agent": {        "ephemeral_id": "91db5bd7-4c69-428c-83d2-01c1bf05ba7c",        "id": "c8d80307-c3e5-45ae-bb30-a0025259b7ae",        "name": "elastic-agent-65963",        "type": "filebeat",        "version": "8.15.1"    },    "data_stream": {        "dataset": "entityanalytics_entra_id.entity",        "namespace": "55663",        "type": "logs"    },    "ecs": {        "version": "8.11.0"    },    "elastic_agent": {        "id": "c8d80307-c3e5-45ae-bb30-a0025259b7ae",        "snapshot": false,        "version": "8.15.1"    },    "event": {        "action": "started",        "agent_id_status": "verified",        "dataset": "entityanalytics_entra_id.entity",        "ingested": "2025-04-01T18:07:39Z",        "kind": "asset",        "original": "{\"input\":{\"type\":\"entity-analytics\"},\"agent\":{\"name\":\"elastic-agent-65963\",\"id\":\"c8d80307-c3e5-45ae-bb30-a0025259b7ae\",\"type\":\"filebeat\",\"ephemeral_id\":\"91db5bd7-4c69-428c-83d2-01c1bf05ba7c\",\"version\":\"8.15.1\"},\"@timestamp\":\"2025-04-01T18:07:36.482Z\",\"ecs\":{\"version\":\"8.11.0\"},\"data_stream\":{\"namespace\":\"55663\",\"type\":\"logs\",\"dataset\":\"entityanalytics_entra_id.entity\"},\"elastic_agent\":{\"id\":\"c8d80307-c3e5-45ae-bb30-a0025259b7ae\",\"version\":\"8.15.1\",\"snapshot\":false},\"event\":{\"start\":\"2025-04-01T18:07:36.482Z\",\"action\":\"started\",\"dataset\":\"entityanalytics_entra_id.entity\"},\"labels\":{\"identity_source\":\"entity-analytics-entityanalytics_entra_id.entity-b4dd8d01-dde7-48c9-8b0f-9c1f991c2117\"},\"tags\":[\"all-entities\",\"preserve_original_event\",\"forwarded\",\"entityanalytics_entra_id-entity\"],\"_version_type\":\"internal\",\"_index\":\"logs-entityanalytics_entra_id.entity-55663\",\"_id\":null,\"_version\":-4}",        "start": "2025-04-01T18:07:36.482Z"    },    "input": {        "type": "entity-analytics"    },    "labels": {        "identity_source": "entity-analytics-entityanalytics_entra_id.entity-b4dd8d01-dde7-48c9-8b0f-9c1f991c2117"    },    "tags": [        "all-entities",        "preserve_original_event",        "forwarded",        "entityanalytics_entra_id-entity"    ]}