Connector setup

Microsoft connector (app-only mode)

Use client credentials for tenant ingestion, map required Graph application permissions, and verify stable background sync.

Updated September 11, 2026 | 10 min

Delegated setupWeekly report guideConnectors in app

When to use app-only mode

Use app-only mode when you need scheduled ingestion independent of an individual delegated refresh token lifecycle.

This mode is generally best for long-running production setups where customer consent and secrets are managed through a service principal governance process.

Microsoft-side preparation

  1. Create or select a Microsoft Entra app registration for ITDR ingestion.
  2. Create a client secret and store the secret value securely.
  3. Capture Tenant ID (Directory ID), Client ID (Application ID), and secret value for ITDR connector setup.
  4. Grant Graph application permissions required for your target telemetry and containment workflows, then click Admin consent.

Information to collect before opening ITDR

Customer valueWhere to find itITDR field
Microsoft tenant IDMicrosoft Entra admin center -> Overview -> Tenant IDMicrosoft tenant ID
Application/client IDApp registrations -> selected app -> Overview -> Application (client) IDClient ID
Client secret valueApp registrations -> Certificates & secrets -> New client secret -> ValueClient secret
Secret expiration dateCertificates & secrets -> Expires columnOperational note / rotation calendar
Admin consent statusAPI permissions -> Status columnValidation reference

Permission baseline

ITDR app-only tokens use `.default` against each resource, so effective permissions are exactly what is granted to your app registration. The groups below are generated from the registry the auto-managed connector uses; grant the required groups and any optional ones you want. Self-rotation (Application.ReadWrite.OwnedBy) is not listed because a bring-your-own app rotates its own secret on your schedule. See What the connector asks for for the purpose and classification of every permission.

Microsoft Graph — ingestion and detection

Required. Identity, device, audit, sign-in, risk and security-alert feeds plus the Identity Risk dashboards (RoleManagement.Read.Directory).

User.Read.AllDirectory.Read.AllOrganization.Read.AllDevice.Read.AllAuditLog.Read.AllReports.Read.AllPolicy.Read.AllIdentityRiskEvent.Read.AllIdentityRiskyUser.Read.AllSecurityAlert.Read.AllSecurityIncident.Read.AllSecurityEvents.Read.AllRoleManagement.Read.Directory

Office 365 Management APIs — mailbox and activity audit

Required for the BEC mailbox-rule detections. Add the Office 365 Management APIs resource to the app registration; without ActivityFeed.Read those four detections cannot fire.

ActivityFeed.ReadActivityFeed.ReadDlpServiceHealth.Read

Microsoft Graph — response actions

Optional. Omit these if the customer only wants detection, posture and reporting; the incident response panel will show the affected actions as unavailable. Both permissions that can escalate to tenant admin are in this group.

User.EnableDisableAccount.AllUser.RevokeSessions.AllGroupMember.ReadWrite.AllApplication.ReadWrite.AllAppRoleAssignment.ReadWrite.AllDelegatedPermissionGrant.ReadWrite.AllDeviceManagementManagedDevices.PrivilegedOperations.All

Microsoft Graph — posture

Optional. Needed for the Microsoft 365 posture scan (Defender for Identity health, SharePoint settings, hybrid sync state).

OnPremDirectorySynchronization.Read.AllSharePointTenantSettings.Read.AllSecurityIdentitiesHealth.Read.AllSecurityIdentitiesSensors.Read.All

Office 365 Exchange Online — posture

Optional. Application-level Exchange access for mailbox-policy and transport-rule posture checks.

Exchange.ManageAsApp

Skype and Teams Tenant Admin API — posture

Optional. Teams admin module access for Teams posture checks.

application_access
Microsoft requires admin consent for application permissions. Adding permissions without clicking Grant admin consent will not give ITDR usable access.

ITDR setup steps

  1. Open Connectors and choose the app-only connector creation path.
  2. Provide Microsoft tenant ID, client ID, and client secret.
  3. Save connector. ITDR validates by requesting a token with scope `https://graph.microsoft.com/.default` and testing organization/user reads.
  4. After creation, run Sync now and review token lanes, warning buckets, and recent run history.

Validation checklist

  • Connector sync status should move from authorized_app_only to healthy or synced_with_warnings after imports run.
  • Graph preview should load organization and sample users.
  • Secure Score route should return data when security permissions and tenant provisioning are in place.
  • Incident response capability panels should not report missing required scopes for planned actions.

Common failure patterns

  • Error: Connector already exists for this Microsoft tenant. Action: reuse existing connector or remove old active connector for that tenant ID.
  • Error: failed to validate credentials. Action: recheck tenant ID/client ID/secret and verify client secret has not expired.
  • Error: missing required scope for action. Action: add that Graph application permission in Entra and re-consent.

Customer handoff template

Use this checklist when a customer admin prepares the connector details before entering them into ITDR.

Tenant ID: <directory tenant id>
Client ID: <application client id>
Client secret value: <secret value, share only through approved secret channel>
Secret expires: <date>
Admin consent granted by: <admin name/email>
Permissions granted: <paste permission list or screenshot reference>