Integrating Microsoft Sentinel with Frontegg allows your application to work with your cloud-native SIEM through the Azure Resource Manager Microsoft.SecurityInsights API — listing and updating incidents, managing alert and automation rules, bookmarks, watchlists, data connectors, and threat intelligence indicators on your behalf.
Microsoft Sentinel does not use an interactive OAuth redirect. Instead, Frontegg authenticates as a Microsoft Entra ID service principal using the client-credentials grant. You register an application in Entra ID, create a client secret, grant that application access to your Sentinel workspace, and provide the workspace coordinates (subscription, resource group, and workspace name).
Prerequisites
Prerequisites
- A Microsoft account with access to the Azure portal
- A Log Analytics workspace onboarded to Microsoft Sentinel
- Permission to register applications in Microsoft Entra ID and to assign Azure RBAC roles on the workspace
Sign in to the Azure portal and open App registrations (search for it in the top bar, or go to Microsoft Entra ID → App registrations). Click New registration.
Fill in the registration form:
- Enter a name for your application (for example,
Frontegg Integration). - Under Supported account types, keep Accounts in this organizational directory only (Single tenant).
- Leave Redirect URI empty — Sentinel uses the client-credentials flow, so no redirect URI is required.
- Click Register.
After registration, you land on the application Overview page. Copy the Application (client) ID and the Directory (tenant) ID — you will need both when configuring the Frontegg portal.
In the left sidebar, under Manage, click Certificates & secrets. On the Client secrets tab, click New client secret.
In the Add a client secret panel, enter a description (for example, Frontegg Integration), choose an expiry period, and click Add.
Save your Client Secret now
Save your Client Secret now
Copy the secret Value immediately after it is created — it is shown only once. After you leave the page you can no longer retrieve it, only the Secret ID.
Open your Log Analytics workspace (search for it, or go to Log Analytics workspaces and select the one onboarded to Sentinel). On the Overview page, note the following values from the Essentials panel:
| Value | Example |
|---|---|
| Subscription ID | xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx |
| Resource group | my-sentinel-rg |
| Workspace Name | my-sentinel-workspace |
In the same workspace, open Access control (IAM) → Add → Add role assignment. On the Role tab, search for and select Microsoft Sentinel Contributor (use Microsoft Sentinel Reader if you only need read access). Click Next, assign it to the application you registered in Step 1, and complete the assignment.
Once you have your Client ID, Client Secret, Directory (tenant) ID, and the workspace coordinates, configure the integration in the Frontegg portal:
- Open the Frontegg portal and navigate to [ENVIRONMENT] → Integrations → Microsoft Sentinel.
- Enter the Client ID and Client Secret in the corresponding fields.
- Enter the Directory (tenant) ID, Azure subscription ID, Resource group, and Log Analytics workspace name.
- Click Save.
Keep your credentials secure
Keep your credentials secure
Never share or commit your Client Secret to version control.