Configure authentication to Microsoft Graph

Important

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Graph Logs from the Previews page. See Manage Azure Databricks previews.

This page shows how to configure Microsoft Graph to enable authentication from Azure Databricks for the Microsoft Graph Logs connector. Use the credentials retrieved from the steps on this page to create a Unity Catalog connection in Azure Databricks.

Prerequisites

• A Microsoft Entra ID tenant that uses Microsoft security products, such as Microsoft Defender XDR or Microsoft Sentinel. The connector ingests the alerts that these products make available through the Microsoft Graph security API. See alert resource type.
• At least the Application Developer role in the tenant to register an application. See Register an application in Microsoft Entra ID.
• The Privileged Role Administrator role to grant admin consent for Microsoft Graph application permissions. See Grant tenant-wide admin consent to an application.

Configure Microsoft Graph

Register a Microsoft Entra ID application, add a client secret, and grant the application the SecurityAlert.Read.All application permission for Microsoft Graph. The connector authenticates as the application itself, so it doesn't use delegated permissions. See List alerts_v2 for the permissions that the API requires.

1. Sign in to the Microsoft Entra admin center. For a US Government tenant in Government Community Cloud (GCC) High or Department of Defense (DoD), sign in to the Azure Government portal at https://portal.azure.us.
2. Browse to Entra ID > App registrations and select New registration.
3. Enter a Name for the application, for example, Databricks Microsoft Graph Logs.
4. Under Supported account types, select Single tenant only - <your tenant>.
5. Select Register.
6. On the Overview page, record the Application (client) ID and the Directory (tenant) ID.
7. Select Certificates & secrets > Client secrets > New client secret.
8. Add a description for the client secret and select an expiration. Client secrets can't last longer than 24 months. See Add and manage app credentials.
9. Select Add, then record the client secret Value. Microsoft Entra doesn't show the value again after you leave the page.
10. Select API permissions > Add a permission > Microsoft Graph > Application permissions.
11. Under Select permissions, expand SecurityAlert and select SecurityAlert.Read.All.
12. Select Add permissions.
13. Select Grant admin consent for <your tenant>, then select Yes.
14. Confirm that the Status column shows Granted for <your tenant> for SecurityAlert.Read.All.
15. Record the following values for the connection:
    • The Microsoft cloud that your tenant runs in: commercial for the global service (including GCC), gcc_high for US Government GCC High, or dod for US Government DoD.
    • The Directory (tenant) ID.
    • The Application (client) ID.
    • The client secret Value.

Before the client secret expires, create a new client secret on the same application and update the Client Secret on the existing Unity Catalog connection.

Next steps

Create a Microsoft Graph Logs connection in Azure Databricks. See Create a Microsoft Graph Logs connection.