MS365 Graph API

This guide walks you through enabling Microsoft Graph API access in CybrHawk SIEM, including onboarding the "User Isolator" functionality.

Requirements:

• Access to Microsoft 365 services (Microsoft 365 Compliance Center, Azure Active Directory)

• E5 or P1/P2 Licensing (CybrHawk will automatically extract available security events based on your license).

---

Step 1: Grant API Permissions in Azure Portal

1. Register an Application

• Create an Application ID and secret as described in the Microsoft 365 Integration Guide.

Create Application

2. Assign Microsoft Graph API Permissions

• In your app registration, go to API permissions.

• Select Microsoft Graph.

API Selection Menu

3. Add Required Permissions

• Click Application permissions.

• Add the following permissions:

Permissions	Data	Requirement
Application.Read.All	Application details and registrations	Required
ConsentRequest.Read.All	Allows the app to read consent requests and approvals without a signed-in user.	Required
Directory.Read.All	Read directory data (users, groups, apps)	Required
deviceAppManagement DeviceManagementConfiguration.Read.All DeviceManagementManagedDevices.Read.All	Access Intune device configuration, compliance policies, assignments, and the properties of Intune-managed devices.	Optional
SecurityAlert.Read.All	Access all security alerts without needing a signed-in user.	Required
SecurityIncident.Read.All	Access all security incidents without needing a signed-in user.	Required
IdentityRiskyUser.Read.All	Access your organisation's risky user data without a signed-in user.	Required
IdentityRiskyServicePrincipal.Read.All	Access your organisation's risky service principal information without a signed-in user.	Required
IdentityRiskEvent.Read.All	Access identity risk event information for the organisation.	Required
User.EnableDisableAccount.All User.RevokeSessions.All	Allows the app to revoke all sign-in sessions for a user and enable or disable user accounts, without requiring a signed-in user.	Optional
User.Read.All	Allows the app to read user profiles without a signed in user.	Required
Device.Read.All	Read your organisation’s device configuration information without a signed-in user.	Required
Reports.Read.All	Allows an app to read all service usage reports without a signed-in user. Services that provide usage reports include Office 365 and Azure Active Directory.	Required
SecurityEvents.Read.All	Allows the app to read your organization's security events without a signed-in user.	Required
AuditLog.Read.All	Allows the app to read and query your audit log activities, without a signed-in user.	Required

User Isolator Permissions

To enable User Isolation (Threat Containment by CybrHawk 24/7 SOC) features, also add:

User.EnableDisableAccount.All
User.RevokeSessions.All

Add Permissions

4. Grant Admin Consent

• Click Grant admin consent and confirm.

Grant Consent

---

Step 2: Configure CybrHawk SIEM

1. Log in to your CybrHawk SIEM Portal.

2. Navigate to Deployments > Integrations.

3. Click Add and select Microsoft Graph.

---

Need Help?

If you have any questions or need further assistance, please contact CybrHawk Support.

---