Integrating Microsoft 365 and Microsoft Defender for Cloud Apps with SecurityCoach

In this article, you will learn how to integrate Microsoft 365 and Microsoft Defender for Cloud Apps, formerly Microsoft Cloud Access Security (MCAS), with SecurityCoach. Once you set up this integration, data provided by Microsoft will be available under the SecurityCoach tab of your KMSAT console. This data can be viewed in SecurityCoach reports and used to create detection rules for real-time coaching campaigns.

Click the links below to learn how to integrate these Microsoft products with SecurityCoach. For general information about SecurityCoach, see our SecurityCoach Product Manual. If you would like to learn how to integrate other Microsoft products with SecurityCoach, see the vendor integration guides in our Knowledge Base.

Jump to:

Set Up the Integration in Your Microsoft Azure Portal

• Register the Application
• Add API Permissions
• Create a Client Secret

Set Up the Integration in Your KMSAT Console

Set Up the Integration in Your Microsoft Azure Portal

Before you can set up the SecurityCoach integration in your KMSAT console, you will need to register the SecurityCoach application, add API permissions, and create a client secret in your Microsoft Azure portal.

To jump to the article subsection for each of these steps, click the links below:

• Register the SecurityCoach Application
• Add API Permissions
• Create a Client Secret

Register the SecurityCoach Application

First, you will need to register the SecurityCoach application in your Microsoft Azure portal. To register the application, follow the steps below:

1. Log in to your Microsoft Azure portal and navigate to your Azure Active Directory.
2. From the sidebar on the left side of the page, select App registrations.
3. Click + New registration and enter a name for your application, such as “SecurityCoachAPIAccess”.
4. Click Register.

Back to top

Add API Permissions

After you have registered the SecurityCoach application, you can add API permissions. To add API permissions, follow the steps below:

1. Log in to your Microsoft Azure portal and navigate to your Azure Active Directory.
2. From the sidebar on the left side of the page, select App registrations.
3. Select the registered application you created for Microsoft 365 or MCAS in the Register the SecurityCoach Application section of this guide. In the example below, the registered application is titled “MS-Alert”.
4. From the sidebar on the left side of the page, select API permissions.

5. Click + Add a permission.

   

6. Select Microsoft Graph from the Microsoft APIs subtab.

   

7. Click Application permissions.

   

8. Click the SecurityEvents drop-down menu and select the check box next to SecurityEvents.Read.All.

   

9. Click Add permissions.

10. Click Grant admin consent for [your active directory name]. Once permission is granted, the triangle symbol on the right side of the page will change to a green check mark.

    

Back to top

Create a Client Secret

After you have registered the SecurityCoach application and added API permissions, you can create a client secret. To create a client secret, follow the steps below:

1. Log in to your Microsoft Azure portal and navigate to your Azure Active Directory.
2. From the sidebar on the left side of the page, select App registrations and click on the registered application you added permissions to in the Add API Permissions section of this article. When you click on the registered application, the application’s overview page will display.
3. From the sidebar on the left side of the page, select Certificates & secrets.
4. Click + New client secret.
5. Enter a description for the client secret and select an expiry window.
6. Click Add. Once you click Add, the client secret Value and Expires date will display.
7. Copy and save the client secret Value and Expires date somewhere that you can easily access. You will need these credentials to complete the integration setup in the Set Up the Integration in Your KMSAT Console section below.

Back to top

Set Up the Integration in Your KMSAT Console

Once you've set up the integration in your Microsoft Azure portal, you can set up the integration in your KMSAT console.

To set up the integration in your KMSAT console, follow the steps below:

1. Log in to your KMSAT console and navigate to SecurityCoach > Setup.
2. In the Available Integrations section, locate the card for the Microsoft application you want to set up.

3. At the bottom of the card, click Configure.

   
4. In a separate browser window, log in to your Microsoft Azure portal and navigate to your Azure Active Directory.
5. From the Overview page, scroll down to the Tenant information section. Then, copy the Primary domain.
6. Navigate back to your KMSAT console. In the Tenant field, paste your Primary domain.
7. To get your client ID, navigate to your Microsoft Azure portal. Select App registrations and click on the registered application you created for Microsoft 365 or MCAS in the Register the SecurityCoach Application section of this article.
8. On the application’s overview page, copy the Application (client) ID in the Essentials section at the top of the page.
9. Navigate back to your KMSAT console. In the Client ID field, paste your Application (client) ID.
10. In the Client Secret field, enter the Value for the client secret that you created in the Create a Client Secret section above.
11. In the Token Expiration Date field, select the Expires date for the client secret that you created in the Create a Client Secret section above.
12. To finish setting up the integration, click Authorize.

Once you’ve successfully authorized this integration, you can manage detection rules for Microsoft 365 or MCAS on the Detection Rules subtab of SecurityCoach. For a full list of available system detection rules for this vendor, see our Which Detection Rules Can I Use with My Vendors? article.

Back to top