Microsoft Sentinel

Create an Azure App Registration for Microsoft Sentinel, generate a client secret, and grant it read access so AiStrike can pull incidents, alerts, and query telemetry.

Prerequisites

• An Azure subscription with Microsoft Sentinel enabled.

• Global Administrator or Application Administrator in Microsoft Entra ID (to create the App Registration where the tenant restricts registrations).

• Subscription Owner or User Access Administrator on the subscription where Sentinel is configured (to assign IAM roles).

Step 1: Create the App Registration

1. Sign in to the Azure portal as an administrator and select Microsoft Entra ID.

2. Go to App registrations > New registration.

3. Enter a name (e.g. AiStrikeAppRegistration) and choose Single tenant only for the account type.

4. Leave the Redirect URI blank and click Register.

5. From the app's Overview, save the Application (client) ID and Directory (tenant) ID for later.

Step 2: Create a client secret

1. Go to Certificates and secrets > New client secret.

2. Add a description and set an expiration matching your contract period (12 months or longer).

3. Click Add, then save the client secret value (not the secret ID). The value is only displayed once.

Step 3: Grant access to the Azure subscription

1. Go to the subscription where Sentinel is configured and open Access control (IAM).

2. Click Add > Add role assignment and assign the roles Microsoft Sentinel Reader and Log Analytics Reader to your app registration.

3. Retrieve the Sentinel Log Analytics workspace details: from the workspace's Overview blade, copy the Resource Group and Workspace Name.

Step 4: (Optional) Assign roles at the Management Group level

1. Go to Management Groups and select the group containing the subscriptions you want to grant access to.

2. Open Access Control (IAM) > Add role assignment and assign Microsoft Sentinel Reader and Log Analytics Reader.

3. Under Members, select the app registration, then click Review and assign and validate under the Role assignments tab.

Management Group-level assignments inherit down to all child subscriptions.

Connector configuration