Skip to content
/
Microsoft Sentinel SIEM C...

Microsoft Sentinel SIEM Configuration Guide

This guide walks you through configuring Microsoft Sentinel as a SIEM provider with Synqly.

Updating an existing deployment? See Updating the Synqly Integration Connector.

The first step depends on whether you need data ingestion. Select the appropriate tab in Step 1:

  • With data ingestion (recommended): Use the Synqly CCF Push connector from the Microsoft Sentinel Content Hub. This automatically provisions the Entra application and the resources needed for ingesting data into Sentinel.
  • Without data ingestion: Manually create a Microsoft Entra ID application.

After the application is created, the remaining steps — permissions, workspace values, and integration configuration — are the same for both paths.

Defender Portal Required

Some Synqly features (such as alerts) require your Sentinel workspace to be connected to the Microsoft Defender portal. Microsoft requires all workspaces to transition by March 31, 2027, and workspaces created after July 2025 are automatically connected.

If your workspace is not yet connected, see our Microsoft Sentinel Defender Portal Migration Guide for instructions.

Step 1: Create the Entra ID Application

The Synqly Integration Connector solution is published in the Microsoft Sentinel Content Hub as a CCF Push connector. Deploying it automatically provisions the Entra application, Data Collection Rule, Data Collection Endpoint, and role assignments in a single step.

Prerequisites:

  • A Microsoft Sentinel workspace
  • Application Developer role (or higher) in Microsoft Entra ID — to create an app registration
  • Owner or User Access Administrator on the Azure subscription — to assign the Monitoring Metrics Publisher role on the Data Collection Rule

Install the solution:

  1. In the Azure portal, navigate to your Microsoft Sentinel workspace
  2. Go to Content Hub
  3. Search for Synqly Integration Connector
  4. Select the solution and click Install

Alternatively, find the solution directly in the Azure Marketplace.

Deploy the connector:

  1. After installation, go to Configuration → Data connectors
  2. Search for and select the Synqly connector
  3. Click Open connector page
  4. Click the Deploy button

The deployment automatically creates:

  • A Microsoft Entra application with credentials
  • A Data Collection Rule (DCR) and Data Collection Endpoint (DCE)
  • Required role assignments (Monitoring Metrics Publisher)

Collect the connection details:

After deployment completes, the connector page displays the following values. Copy each one — you will need them later:

  • Tenant ID
  • Application (Client) ID
  • Client Secret
  • Data Collection Endpoint URI (this is the Ingest URL)
  • Data Collection Rule Immutable ID (this is the Rule ID)
  • Stream Name

Updating the solution later does not refresh the DCR created here. See Updating the Synqly Integration Connector.

Step 2: Assign Permissions

Regardless of which option you chose above, the application needs the following permissions:

  • Microsoft Sentinel Contributor role on the Log Analytics workspace
  • SecurityAlert.Read.All Microsoft Graph API application permission (with admin consent granted)

Add Azure role assignments on the Log Analytics workspace:

  1. In the Azure portal, navigate to the Log Analytics workspace used by Sentinel
  2. Go to Access control (IAM) → + Add → Add role assignment
  3. Search for a role from the list below, select it, and click Next
    • Microsoft Sentinel Contributor
  4. Click + Select members, add the application from Step 1, and click Select
  5. Click Review + assign
  6. Repeat steps 2–5 until all roles above have been assigned

Add Microsoft Graph API permissions:

  1. Go to Microsoft Entra ID → App registrations
  2. Select the application from Step 1
  3. Go to API permissions → Add a permission
  4. Select Microsoft Graph → Application permissions
  5. Search for a permission from the list below, check it, and click Add permissions
    • SecurityAlert.Read.All
  6. Repeat steps 3–5 until all permissions above have been added
  7. Back on the API permissions page, click Grant admin consent for [your tenant]

The admin consent step requires a Global Administrator or Privileged Role Administrator. This is a one-time action.

Step 3: Gather the Log Analytics Workspace Values

  1. In the Azure portal, navigate to your Log Analytics workspace
  2. On the Overview page, note the following values:
    • Resource Group
    • Subscription ID
    • Workspace Name
    • Workspace ID

Step 4: Configure the Integration

Create your integration by supplying the following values.

Tenant ID The Directory (tenant) ID from your Entra application (Step 1).

Client ID The Application (client) ID from your Entra application (Step 1).

Client Secret The client secret value from your Entra application (Step 1).

Resource Group The Azure resource group name containing the Sentinel workspace (Step 3).

Subscription ID The Azure subscription ID containing the Sentinel workspace (Step 3).

Workspace ID The Log Analytics workspace ID (Step 3).

Workspace Name The Log Analytics workspace name (Step 3).

Ingest URL (ingestion only) The Data Collection Endpoint URI from the CCF Push connector deployment (Step 1, CCF Push Connector tab).

Rule ID (ingestion only) The Data Collection Rule Immutable ID from the CCF Push connector deployment (Step 1, CCF Push Connector tab).

Stream Name (ingestion only) The Stream Name from the CCF Push connector deployment (Step 1, CCF Push Connector tab).

Logs URL (optional) The root URL for the Microsoft Azure Monitor Logs API. Only needed for alternate Microsoft clouds such as GovCloud. Default: https://api.loganalytics.azure.com

Management URL (optional) The root URL for the Microsoft Azure Management API. Only needed for alternate Microsoft clouds such as GovCloud. Default: https://management.azure.com

Updating the Synqly Integration Connector

Updating the solution in Content Hub does not refresh the Data Collection Rule (DCR) created when you deployed the connector. Event types added by the newer version are accepted by the ingestion API and then silently dropped, and nothing in the portal signals it — the connector page shows the new version either way.

Whenever you update the solution, complete all four steps:

  1. Update the Synqly Integration Connector solution in Content Hub.
  2. On the connector page, click Revoke, then Deploy. This rewrites the DCR from the updated template. The Data Collection Endpoint URI, Rule ID, and Stream Name do not change.
  3. Copy the new Application (Client) ID and Client Secret from the connector page into your Synqly integration. Deploy always issues new credentials — the previous ones stop working.
  4. Wait about 15 minutes before sending test data. A DCR change takes 5–15 minutes to reach the ingestion path.

Revoke deletes the connector's Entra application, so ingestion stops until you redeploy and update your integration with the new credentials. Any permissions you granted that application by hand must be re-applied to the new one.

Rolling the application this way is the path we recommend, and the one Microsoft's support team walked us through: it keeps the DCR aligned with the solution template. If rotating the credentials is genuinely not workable in your environment, get in touch with Synqly support — the DCR can be updated in place, but it requires more detailed instructions and direct modification of Azure resources.

If alerts stop returning after a redeploy, re-apply Step 2 to the new application — Deploy does not carry the workspace role or the Graph permission over.

Microsoft Sentinel: Migrating to the Defender Portal

Microsoft Sentinel Sink Configuration Guide