6.2 Microsoft First-Party Connectors

Microsoft First-Party Connectors

By the end of this subsection, you will know every Microsoft connector available, which ones to enable, and how to verify each is working with diagnostic queries.

You enabled the two most critical connectors in Module 5. This subsection covers the remaining Microsoft connectors and teaches you to verify they are all healthy.

Complete connector inventory

Azure Activity — enable now (free)

Navigate to Sentinel, Data connectors, Azure Activity, Open connector page, select subscription, Connect. Takes 30 seconds.

This sends all Azure management plane events: resource creation, deletion, modification, role assignments, policy changes. Cost: zero. Value: critical for detecting attackers who compromise Azure credentials and create resources (cryptomining VMs), modify security settings (disable logging), or escalate privileges (assign Global Admin).

1
2
3
4

AzureActivity
| where TimeGenerated > ago(24h)
| summarize EventCount = count() by CategoryValue
| sort by EventCount desc

Detection rule opportunity: Alert on Azure role assignments outside business hours or to users who have never held privileged roles:

1
2
3
4
5
6
7

AzureActivity
| where CategoryValue == "Administrative"
| where OperationNameValue has_any ("roleAssignments/write", "roleDefinitions/write")
| extend Hour = hourofday(TimeGenerated)
| where Hour < 7 or Hour > 20
| project TimeGenerated, Caller, OperationNameValue,
    tostring(Properties.requestbody)

Office 365 — enable now (free)

Navigate to Sentinel, Data connectors, Office 365, enable Exchange, SharePoint, and Teams. Takes 30 seconds.

This populates OfficeActivity with detailed user activity across all M365 services. The table is distinct from what the M365 Defender connector provides.

1
2
3
4
5
6

OfficeActivity
| where TimeGenerated > ago(24h)
| summarize EventCount = count(), Users = dcount(UserId) by OfficeWorkload, Operation
| where EventCount > 100
| sort by EventCount desc
| take 15

Connector health dashboard — run at every shift start

After enabling all Microsoft connectors, this single query confirms your entire data pipeline:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

union withsource=TableName
    AzureActivity,
    OfficeActivity,
    SigninLogs,
    AADNonInteractiveUserSignInLogs,
    DeviceProcessEvents,
    EmailEvents,
    CloudAppEvents,
    AuditLogs
| where TimeGenerated > ago(24h)
| summarize
    EventCount = count(),
    LastEvent = max(TimeGenerated),
    HoursAgo = round(datetime_diff('minute', now(), max(TimeGenerated)) / 60.0, 1)
    by TableName
| sort by HoursAgo desc