Microsoft Sentinel

Overview

This guide provides step-by-step instructions on creating an Azure App Registration for MS Sentinel. It also includes the necessary permissions required for the user performing this setup. This guide will help you with the following:◼︎

• Create the Azure App Registration.

• Create a client secret for the app.

• Grant the registered Azure App Registration access to the Azure subscription for MS Sentinel.

Prerequisites

Before starting, ensure you have the following:

• An Azure subscription with Microsoft Sentinel enabled

• Global Administrator or Application Administrator role in Microsoft Entra ID (required to create the App Registration where the tenant restricts app registrations)

• Subscription Owner or User Access Administrator role on the Azure subscription where Sentinel is configured (required to assign IAM roles)

Step 1: Create the Azure App Registration

1. Sign in to the Azure portal as an administrator.

2. Select Microsoft Entra ID.

3. Go to App registrations > New registration.

4. Enter the name of the app (AiStrikeAppRegistration).

5. Select the applicable supported account type. Choose: Single tenant only

   

6. Leave the Redirect URI blank.

7. Click Register.

8. Save the Application (client) ID and Directory (tenant) ID values to use them later when configuring the integration parameters. This information is available in the Overview of App.

   

Step 2: Create client secret

1. Navigate to Certificates and secrets > New client secret.

2. Provide a description for a client secret and set its expiration deadline as per your contract period (12 months or longer).

3. Click Add.

4. Save the value of the client secret (not the secret ID) to use it as the Client Secret parameter value when configuring the integration. The client secret value is only displayed once.

Step 3: Give app access to the Azure subscription

1. Go to the Microsoft subscription where Sentinel is configured.

2. Click Access control (IAM).

3. In the Add a role assignment section, click Add.

4. Configure the following parameters:

   • Role = Microsoft Sentinel Reader & Log Analytics Reader.

   • Assign access to = User, group, or service principal.

   • Click Select members.

NOTE: Sentinel Reader = incidents/alerts; Log Analytics Reader = KQL queries

5. In the Select section, provide a search condition to find your app and add a role assignment for your app (AiStrikeAppRegistration).

6. To get the Sentinel log analytics workspaces details. Search for Subscriptions, then select the one hosting Sentinel: From the workspace's Overview blade, copy the Resource group and Name.

   • Resource Group

   • Workspace Name

     

Step 4: (Optional) Assigning Roles at the Management Group Level

Using Azure Portal:

1. Go to Management Groups.

2. Click on the management group that contains the subscriptions you want to provide access to (e.g., 'Management Group Default[Main]'). To grant access across all subscriptions with Sentinel, select the correct group.

   

3. Click "Access Control (IAM)" on the left menu.

4. Click Add role assignment.

   • Role = Microsoft Sentinel Reader & Log Analytics Reader.

NOTE: Sentinel Reader = incidents/alerts; Log Analytics Reader = KQL queries

5. Under Members, select the app registration.

6. Search for the app registration name and select it.

7. Click Review and assign.

8. Validate the assignment under the Role assignments tab.

NOTE: Management Group-level assignments inherit down to all child subscriptions.

Parameters required to configure the AiStrike connector (Microsoft Sentinel)