Overview

The Microsoft Entra ID data connector enables seamless ingestion of identity security events into Torq for use in workflows and Auto Triage. This connector is designed to integrate directly with Microsoft Entra ID (formerly Azure Active Directory), allowing you to automatically ingest identity-related events such as risky sign-ins, risk detections, and audit logs.

Integrations and data connectors

Torq supports two approaches to connecting with Microsoft Entra ID:

Integration: A custom approach to pulling data from Microsoft Entra ID. Requires additional work such as transformation, deduplication, and routing logic to make the data usable within workflows.
Data connector: A plug-and-play solution that handles ingestion, transformation, deduplication, and related logic out of the box, with minimal setup required. This article covers the Microsoft Entra ID data connector.

Key benefits

Simplified setup: Configure ingestion through a guided UI without building custom integrations.
Continuous ingestion: Events are retrieved automatically at regular intervals.
Auto Triage integration: Route identity events directly into automated triage and case creation.
Historical backfill: Ingest past events during initial setup (up to 14 days, subject to Entra retention).
Built-in reliability: Handle retries, deduplication, and rate limits automatically.

Common scenarios

Automated triage for risky sign-ins

Risky sign-ins (for example, impossible travel or anonymous IP usage) are automatically ingested and analyzed by Auto Triage. Events are enriched with user and device context, evaluated based on risk signals, and can trigger automated remediation actions such as session revocation or MFA enforcement.

Identity Protection risk detection response

Microsoft Entra ID Identity Protection generates user-level and sign-in-level risk detections (for example, leaked credentials or token anomalies). These detections are ingested into Torq and used to trigger automated workflows for investigation, correlation, and response.

Audit log automation and compliance

Audit logs capture directory activity such as user changes, role assignments, and policy updates. The connector enables automation for compliance monitoring, privilege escalation detection, and audit trail workflows.

Prerequisites

Before setting up the Microsoft Entra ID data connector, ensure the following requirements are met:

Microsoft Entra ID tenant access: Access to Microsoft Entra ID with appropriate permissions.
Microsoft Entra application: A registered application for authentication.
Permissions: Configure the required Microsoft Graph permissions based on the selected event types.

How to use

Create an app registration in Microsoft Entra ID

Navigate to app registrations

Open Azure Portal: Go to https://portal.azure.com/.
Go to app registrations: Navigate to Microsoft Entra ID > App registrations > New registration.

Register the application

Enter application name: Provide a unique, meaningful name (e.g., Torq Entra Connector).
Set supported account type: Select Accounts in this organizational directory only.
Create app: Click Register.

Collect application details

Copy identifiers: From the application overview page, copy:
- Application (Client) ID
- Directory (Tenant) ID
Store securely: Save these values for use during Torq configuration.

Create client secret

Navigate to secrets: Go to Certificates & secrets.
Create secret: Click New client secret.
Define secret: Add a description (e.g., Torq Secret) and select an expiration period.
Save secret: Click Add.
Copy secret value: Immediately copy the secret from the Value column and store it securely.

The secret value is only visible once and cannot be retrieved later.

Configure API permissions

Open permissions: Go to API permissions.
Add permissions: Click Add a permission > Microsoft Graph > Application permissions.
Grant required permissions: Add:
- AuditLog.Read.All (Directory audit logs)
- IdentityRiskEvent.Read.All (Risk detections)
- IdentityRiskyUser.Read.All (Risky users and sign-ins)

Grant admin consent

Approve permissions: Click Grant admin consent.
Confirm action: Approve the request to apply permissions organization-wide.

Set up a data connector instance

Open connector setup: Go to Integrations > Microsoft Entra ID > Add Instance.
Configure connection details:
- Name: Enter a descriptive name.
- Tenant ID: Enter your Microsoft Entra tenant ID.
- Client ID: Enter the application (client) ID.
- Client Secret: Enter the generated client secret.
- Microsoft Graph URL: Enter the Microsoft Graph base URL used by your environment.
Select event types: Choose which events to ingest:
- Directory Audit Logs
- Risky Sign-In Logs
- Risk Detections
(Optional) Configure backfill: Set a lookback window to ingest historical events (up to 14 days, subject to retention).
Select routing destination: Choose where ingested events will be sent:
- Workflows
- Auto Triage
(Optional) Conditional filters: Add one or more field-based conditions to control which events are ingested. See Conditional filters below.
Save configuration: Click Add to create the connector. Ingestion starts automatically.

When you edit an existing Entra ID instance, the past data ingestion period cannot be changed. To change it, delete the instance and create a new one.

You’ve successfully set up the Microsoft Entra ID Data Connector in Torq. With the connector configured, Torq continuously ingests identity events and enables automated triage, investigation, and response workflows across your identity security stack.

Conditional filters

Conditional filters limit which events are ingested from the connector. Only events that match all defined conditions are passed, reducing noise and preserving ingestion quota.

Each condition consists of a field reference and an operator. Some operators require an additional value. Conditions are joined by AND or OR logic, selected when adding each new condition.

Add a condition

Use conditional filters to control which events are processed based on field values.

Add a condition row: In the Conditional filters section, click +, then select AND or OR to define how the condition relates to the previous one.
Enter a field reference: In the left input, enter a field reference, for example {{ $.event.riskLevel }}.
Select an operator: Choose an operator from the dropdown. Available operators: Equals, Not Equals, Is In, Is Not In, Contains, Not Contains, Regex Match, Regex Not Match, Is Empty, Not Empty.
Enter a value: If the operator requires a value, enter it in the field below, for example ["high"].

To remove a condition, click the Delete icon on the right of the condition row.

Example

The following configuration ingests only Risky Sign-In and Risk Detection events where riskLevel is not empty, and its value is high:

{{ $.event.detectedDateTime }}: Not Empty
AND {{ $.event.riskLevel }}: Not Empty
AND {{ $.event.riskLevel }} Is In ["high"]

Default risk ingestion

Both risk detections and risky sign-ins are ingested only when their risk level is High. Medium and Low risk events are filtered out before reaching Auto Triage.

High is the top of Entra ID's risk scale. Identity Protection uses Low / Medium / High with no Critical tier, so this default forwards the most severe identity risks while suppressing lower-confidence noise. Directory Audit Logs do not carry a risk level and are ingested regardless.
This threshold can be adjusted per connection instance if you need to include lower-risk events for a specific source.

Event type	What it is	Ingested when
Risk detections	Individual detected risk events	Risk level is High
Risky sign-ins	Sign-ins with an aggregated risk level	Aggregated risk level is High