Connect the Microsoft Entra ID Protection connector

  • 3 minutes

Microsoft Entra ID Protection provides a consolidated view of at-risk users, risk events, and vulnerabilities, with the ability to remediate risk immediately and set policies to autoremediate future events.

To view the connector page, do the following steps:

  1. Select Data connectors page.

  2. Select Microsoft Entra ID Protection.

  3. Then select the Open connector page on the preview pane.

  4. Select Connect to start streaming the Microsoft Entra ID Protection alerts.

  5. Select whether alerts from Microsoft Entra ID Protection automatically generate incidents by selecting Enable.

Screen shot of the Microsoft Entra ID Protection connector page.

If you enable creating incidents, the default analytics rule "Create incidents based on Microsoft Entra ID Protection alerts" is enabled with default values. You can edit this analytical rule on the Analytics page.