Connector setup

Microsoft connector (app-only mode)

Use client credentials for tenant ingestion, map required Graph application permissions, and verify stable background sync.

Updated May 5, 2026 | 10 min

Delegated setupWeekly report guideConnectors in app

When to use app-only mode

Use app-only mode when you need scheduled ingestion independent of an individual delegated refresh token lifecycle.

This mode is generally best for long-running production setups where customer consent and secrets are managed through a service principal governance process.

Microsoft-side preparation

  1. Create or select a Microsoft Entra app registration for ITDR ingestion.
  2. Create a client secret and store the secret value securely.
  3. Capture Tenant ID (Directory ID), Client ID (Application ID), and secret value for ITDR connector setup.
  4. Grant Graph application permissions required for your target telemetry and containment workflows, then click Admin consent.

Information to collect before opening ITDR

Customer valueWhere to find itITDR field
Microsoft tenant IDMicrosoft Entra admin center -> Overview -> Tenant IDMicrosoft tenant ID
Application/client IDApp registrations -> selected app -> Overview -> Application (client) IDClient ID
Client secret valueApp registrations -> Certificates & secrets -> New client secret -> ValueClient secret
Secret expiration dateCertificates & secrets -> Expires columnOperational note / rotation calendar
Admin consent statusAPI permissions -> Status columnValidation reference

Permission baseline

ITDR app-only tokens use Microsoft Graph `.default`. Effective permissions are whatever application permissions are granted to the app registration.

Base ingestion

Organization.Read.AllDirectory.Read.AllUser.Read.AllDevice.Read.AllAuditLog.Read.AllReports.Read.AllPolicy.Read.AllSecurityEvents.Read.All

Identity Risk dashboards

RoleManagement.Read.Directory

Risk enrichment

IdentityRiskEvent.Read.AllIdentityRiskyUser.Read.AllSecurityAlert.Read.AllSecurityIncident.Read.All

Containment actions

User.EnableDisableAccount.AllUser.RevokeSessions.AllGroupMember.ReadWrite.All

Workload automation actions

Application.ReadWrite.All
Microsoft requires admin consent for application permissions. Adding permissions without clicking Grant admin consent will not give ITDR usable access.

ITDR setup steps

  1. Open Connectors and choose the app-only connector creation path.
  2. Provide Microsoft tenant ID, client ID, and client secret.
  3. Save connector. ITDR validates by requesting a token with scope `https://graph.microsoft.com/.default` and testing organization/user reads.
  4. After creation, run Sync now and review token lanes, warning buckets, and recent run history.

Validation checklist

  • Connector sync status should move from authorized_app_only to healthy or synced_with_warnings after imports run.
  • Graph preview should load organization and sample users.
  • Secure Score route should return data when security permissions and tenant provisioning are in place.
  • Incident response capability panels should not report missing required scopes for planned actions.

Common failure patterns

  • Error: Connector already exists for this Microsoft tenant. Action: reuse existing connector or remove old active connector for that tenant ID.
  • Error: failed to validate credentials. Action: recheck tenant ID/client ID/secret and verify client secret has not expired.
  • Error: missing required scope for action. Action: add that Graph application permission in Entra and re-consent.

Customer handoff template

Use this checklist when a customer admin prepares the connector details before entering them into ITDR.

Tenant ID: <directory tenant id>
Client ID: <application client id>
Client secret value: <secret value, share only through approved secret channel>
Secret expires: <date>
Admin consent granted by: <admin name/email>
Permissions granted: <paste permission list or screenshot reference>