If you are currently sending Azure Active Directory logs to us, we might request an adjustment to your configuration to enable the ingestion of logs from additional Microsoft products like SharePoint, Exchange, and Teams. To implement this modification, please follow the steps outlined below:
Microsoft Entra ID is the new name for Azure AD.
The names Azure Active Directory, Azure AD, and AAD are replaced with Microsoft Entra ID.
Log in to portal.azure.com.
Once logged in, Search for and select Azure Active Directory or Entra ID. This will take you to the Azure AD or Entra ID dashboard.
Under the Azure AD or Entra ID section, click on App Registrations. Here, you'll find a list of your existing app registrations.
Find and select the application for which you want to generate a new client secret. Click on the application's name to access its settings.
In your application's settings, click on the Certificates & secrets option in the left-hand menu.
Under the Client Secrets section, click on the + New client secret button.
Enter a description for the client secret to help you identify its purpose (e.g., Defense.com SIEM). Next, set the expiration duration to 365 days (12 months) to ensure the secret remains valid for one year.
After configuring the client secret, click the Add button. The client secret will be generated and displayed on the screen.
Make a note of the following essential details:
Application (client) ID: This is your application's unique identifier in Azure AD. It's displayed at the top of the application's overview page.
Directory (tenant) ID: This is your Azure AD tenant's unique identifier. You can find it on the Azure AD overview page.
Client Secret Value: The actual client secret you generated. Copy and save it securely because you won't be able to retrieve it again.
Expiry date: Note the date when the client secret will expire. In this case, it's set to expire in one year.
That's it! 🎉Leave the rest to us and we'll let you know when the change is complete!