Connect CyberArk Identity to Microsoft Defender for Identity (Preview)

Learn how to connect Microsoft Defender for Identity to your existing CyberArk Identity account by using the connector APIs. Connecting Defender for Identity to CyberArk Identity gives you visibility into and control over CyberArk identities. Before you begin, review the Prerequisites to confirm you have the required roles and permissions.

Prerequisites

Before connecting your CyberArk Identity to Microsoft Defender for Identity, make sure the following prerequisites are met:

CyberArk Identity roles

The System Admin role is required to create an application.

Microsoft Entra and Defender role-based access options

To configure the CyberArk Identity connector in Microsoft Defender for Identity, your account must have either of the following access configurations assigned:

Microsoft Entra roles:
- Security Operator
- Security Admin
Defender Unified RBAC permission:
- Core security settings (manage)

Connect CyberArk Identity to Microsoft Defender for Identity

This procedure explains how to connect Microsoft Defender for Identity to a dedicated CyberArk Identity account by using the connector APIs. Connecting Defender for Identity to a dedicated CyberArk Identity account gives you visibility into and control over CyberArk Identity use.

Create a custom CyberArk Identity role

Create a custom role in CyberArk Identity with User Management administrative rights:

Sign in to CyberArk Identity console as a system administrator.
Navigate to Identity Administration > Core Services > Roles
Select Add Role.
Add an appropriate name for the custom role.
Select Save.
Select Administrative Rights and add rights for User Management.
Select Save.

Create a CyberArk OAuth Confidential Client

To support ongoing API access, create a new user and assign the custom role. If you need to tag identities as privileged accounts in the Microsoft Defender portal, you must also add the user to the Privileged Cloud Auditors role.

Sign in to CyberArk Identity console as a system administrator.
Navigate to Identity Administration > Core Services > Users.
Select Add User.
Enter the Login Name and Display Name.
Under Status, select Is OAuth confidential client.
Copy the username and password. You enter these credentials when you configure the CyberArk Identity connector in the Microsoft Defender portal.
Select Create User.
Navigate to the custom role that you created in Create a custom CyberArk Identity role.
Select Members and add the user as a member.
Select Save.
Add the user to the Privileged Cloud Auditors role. This role is required to tag identities in the Microsoft Defender portal as privileged accounts.

Connect CyberArk Identity to Defender for Identity

Configure the CyberArk Identity data connector in the Microsoft Defender portal:

Sign in to the Microsoft Defender Portal.
Go to System > Data Management > Data Connectors.
Select Catalog > CyberArk Identity.
Select on Connect a connector
Enter a name for your connector.
To determine the CyberArk Identity endpoint URL:
1. In CyberArk Identity, select the signed-in user.
2. Select About.
3. Copy the Identity ID value.
4. Add .id.cyberark.cloud to the Identity ID. For example, contoso.id.cyberark.cloud.
Enter your CyberArk Identity Privilege Cloud service endpoint.
1. In the CyberArk Identity Admin console, go to Identity Administration > Settings > Integration and locate the PVWA URL. Use the value after https://. For example,contoso.privilegecloud.cyberark.cloud
Enter the username and password for the Oauth user. Include the complete username and the CyberArk domain.
Select Next.
Select Protection Types > Identity, and select Next.
Review the information and select Connect.
Verify that the CyberArk Identity connector appears in the My Connector table as Connection Status: Ok.
To setup Actions, go to Microsoft Sentinel > Configuration > Automation.
Select Integration profile and create one for CyberArk by using the OAuth user's username and password.