## Microsoft Sentinel integration

Integrating Microsoft Sentinel with Frontegg allows your application to work with your cloud-native SIEM through the Azure Resource Manager `Microsoft.SecurityInsights` API — listing and updating incidents, managing alert and automation rules, bookmarks, watchlists, data connectors, and threat intelligence indicators on your behalf.

Microsoft Sentinel does not use an interactive OAuth redirect. Instead, Frontegg authenticates as a **Microsoft Entra ID service principal** using the client-credentials grant. You register an application in Entra ID, create a client secret, grant that application access to your Sentinel workspace, and provide the workspace coordinates (subscription, resource group, and workspace name).

Prerequisites
- A Microsoft account with access to the [Azure portal](https://portal.azure.com/)
- A Log Analytics workspace onboarded to Microsoft Sentinel
- Permission to register applications in Microsoft Entra ID and to assign Azure RBAC roles on the workspace


### Register a service principal in Microsoft Entra ID

#### Step 1: Open App registrations

Sign in to the [Azure portal](https://portal.azure.com/) and open **App registrations** (search for it in the top bar, or go to **Microsoft Entra ID → App registrations**). Click **New registration**.

![Azure App registrations page](/assets/microsoft-sentinel-1.f5775648e5cf5912d2d9c0053c9f992f48e4666840266a1dc382e91b650565e5.1ce25488.png)

#### Step 2: Register the application

Fill in the registration form:

1. Enter a name for your application (for example, `Frontegg Integration`).
2. Under **Supported account types**, keep **Accounts in this organizational directory only (Single tenant)**.
3. Leave **Redirect URI** empty — Sentinel uses the client-credentials flow, so no redirect URI is required.
4. Click **Register**.


![Register an application form](/assets/microsoft-sentinel-2.2b330f5d146dba1d6ea1a580241dcb2528918c1aa911984484d571c1d365f421.1ce25488.png)

#### Step 3: Copy the Application (client) ID and Directory (tenant) ID

After registration, you land on the application **Overview** page. Copy the **Application (client) ID** and the **Directory (tenant) ID** — you will need both when configuring the Frontegg portal.

![Application overview with client ID and tenant ID](/assets/microsoft-sentinel-3.913cd924ddf31fbef43409652a83423f678b66f850cebbcfa7966b24abe3658c.1ce25488.png)

#### Step 4: Open Certificates & secrets

In the left sidebar, under **Manage**, click **Certificates & secrets**. On the **Client secrets** tab, click **New client secret**.

![Certificates and secrets page](/assets/microsoft-sentinel-4.00eb8a9989d24af2ea3049f68c0d750c55d846b90769d06ca10d201efd5f1e01.1ce25488.png)

#### Step 5: Add a client secret

In the **Add a client secret** panel, enter a description (for example, `Frontegg Integration`), choose an expiry period, and click **Add**.

Save your Client Secret now
Copy the secret **Value** immediately after it is created — it is shown only once. After you leave the page you can no longer retrieve it, only the Secret ID.

![Add a client secret panel](/assets/microsoft-sentinel-5.dd9ba49b0bcd8a75ca037837b5786ec146fbf876f35fc524bc6616c12991ebac.1ce25488.png)

### Connect the Sentinel workspace

#### Step 6: Note your subscription, resource group, and workspace

Open your Log Analytics workspace (search for it, or go to **Log Analytics workspaces** and select the one onboarded to Sentinel). On the **Overview** page, note the following values from the **Essentials** panel:

| Value | Example |
|  --- | --- |
| **Subscription ID** | `xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx` |
| **Resource group** | `my-sentinel-rg` |
| **Workspace Name** | `my-sentinel-workspace` |


![Log Analytics workspace overview essentials](/assets/microsoft-sentinel-6.f520c310c080e13ed21425f05fb0be08499c4e99129360d64a9d0e0cf8a4f1b6.1ce25488.png)

#### Step 7: Grant the application access to the workspace

In the same workspace, open **Access control (IAM)** → **Add** → **Add role assignment**. On the **Role** tab, search for and select **Microsoft Sentinel Contributor** (use **Microsoft Sentinel Reader** if you only need read access). Click **Next**, assign it to the application you registered in Step 1, and complete the assignment.

![Add role assignment with Microsoft Sentinel Contributor selected](/assets/microsoft-sentinel-7.54c7a2eef818e2049ea6ede1b5ffd2f437f657b08545315e6934856eb180e3e4.1ce25488.png)

### Configure the Frontegg portal

Once you have your **Client ID**, **Client Secret**, **Directory (tenant) ID**, and the workspace coordinates, configure the integration in the Frontegg portal:

1. Open the **Frontegg portal** and navigate to **[ENVIRONMENT]** → **Integrations** → **Microsoft Sentinel**.
2. Enter the **Client ID** and **Client Secret** in the corresponding fields.
3. Enter the **Directory (tenant) ID**, **Azure subscription ID**, **Resource group**, and **Log Analytics workspace** name.
4. Click **Save**.


Keep your credentials secure
Never share or commit your Client Secret to version control.

### Additional resources

- [Microsoft Sentinel REST API reference](https://learn.microsoft.com/en-us/rest/api/securityinsights/)
- [Microsoft identity platform and the OAuth 2.0 client credentials flow](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-client-creds-grant-flow)
- [Azure portal](https://portal.azure.com/)