Microsoft Entra ID Entity Analytics

This integration retrieves users and devices, with group memberships from Microsoft Entra ID(formerly Azure Active Directory).

This module has been tested against the Microsoft Graph REST API v1.0.

The Microsoft Entra ID Entity Analytics integration collects two types of data: user and device. While configuring the integration, you can use the Dataset dropdown option to select which type of data you want to collect from Microsoft Entra ID.

Elastic Agent must be installed for standard deployments. For more details, check the Elastic Agent installation instructions.

Elastic Managed integrations are only supported on Elastic Cloud Serverless and Elastic Cloud Hosted deployments. An Elastic Managed integration lets you ingest data from a cloud source while avoiding the orchestration, management, and maintenance associated with standard ingest infrastructure. Elastic runs the collector for you, so you can focus on your data instead of the infrastructure that collects it. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.

For more information, refer to Elastic Managed integrations and the Elastic Managed integrations FAQ.

The Microsoft Graph API is a public HTTPS endpoint, so no special connectivity configuration is required.

When using an Elastic Managed integration, the request tracer option is not available because it writes to the agent's local filesystem.

The following Azure API permissions are required:

If you want to collect device properties that are managed by Microsoft Intune, the following additional permission is required:

Without this permission, the following device fields will return null values even if the devices are enrolled in Intune:

• entityanalytics_entra_id.device.is_compliant
• entityanalytics_entra_id.device.is_managed
• entityanalytics_entra_id.device.compliance_expiration_date_time
• entityanalytics_entra_id.device.category
• entityanalytics_entra_id.device.ownership
• entityanalytics_entra_id.device.enrollment_profile_name
• entityanalytics_entra_id.device.mdm_app_id

To collect these fields, enable the Intune Managed Device Properties toggle in the integration settings. When enabled, the integration requests the additional fields from the Graph API automatically.

When the toggle is enabled, do not set select.devices in Custom Options as the two settings will conflict. Other Custom Options settings are unaffected. Users who need a fully custom device field list should use Custom Options directly with the toggle disabled.

For more details on how to set up the necessary App Registration, permission granting, and secret configuration, refer to this guide.

1. In Kibana navigate to Management > Integrations.
2. In the search bar, type Microsoft Entra ID Entity Analytics.
3. Select the Microsoft Entra ID Entity Analytics integration and add it.
4. While adding the integration, add the Tenant ID, Client (Application) ID and Secret (API Key) that you obtained earlier.
5. Save the integration.

The integration periodically contacts Microsoft Entra ID using the Graph API, retrieving updates for users, devices, and groups, updates its internal cache of metadata and group membership information, and ships updated records to Elasticsearch.

Fetching and shipping updates occurs in one of two processes: full synchronizations and incremental updates. Full synchronizations send the entire list of users and devices in state. Incremental updates send only records that changed since the last sync. Changes include metadata updates, additions, deletions, and group membership changes (direct or transitive). By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case.

By default this integration uses minimal-state sync, which routes user and device documents directly to the user and device data streams. Existing policies are updated to use minimal-state sync on upgrade. Minimal-state sync and the User Sign-in Activity enrichment require Elastic Agent 9.5.0 or later; older agents use the legacy sync without sign-in activity.

This integration provides an asset inventory, a point-in-time snapshot of which users and devices exist and their current properties. It does not provide an audit trail of who changed what, or when. If you need to track administrative changes to Entra ID objects (user modifications, deletions, group membership changes by an administrator, etc.), use the Azure integration's audit logs data stream, which collects Entra ID audit logs via Event Hub.

A user document:

{
  "@timestamp": "2022-11-04T09:57:19.786056-05:00",
  "azure_ad": {
    "userPrincipalName": "example.user@example.com",
    "mail": "example.user@example.com",
    "displayName": "Example User",
    "givenName": "Example",
    "surname": "User",
    "jobTitle": "Software Engineer",
    "mobilePhone": "123-555-1000",
    "businessPhones": [
      "123-555-0122"
    ]
  },
  "user": {
    "id": "5ebc6a0f-05b7-4f42-9c8a-682bbc75d0fc",
    "group": [
      {
        "id": "331676df-b8fd-4492-82ed-02b927f8dd80",
        "name": "group1"
      },
      {
        "id": "d140978f-d641-4f01-802f-4ecc1acf8935",
        "name": "group2"
      }
    ]
  },
  "labels": {
    "identity_source": "azure-1"
  }
}

A device document:

{
  "@timestamp": "2022-11-04T09:57:19.786056-05:00",
  "azure_ad": {
    "accountEnabled": true,
    "displayName": "DESKTOP-LETW452G",
    "operatingSystem": "Windows",
    "operatingSystemVersion": "10.0.19043.1337",
    "physicalIds": {
      "extensionAttributes": {
        "extensionAttribute1": "BYOD-Device"
      }
    },
    "alternativeSecurityIds": [
      {
        "type": 2,
        "identityProvider": null,
        "key": "DGFSGHSGGTH345A...35DSFH0A"
      }
    ]
  },
  "device": {
    "id": "2fbbb8f9-ff67-4a21-b867-a344d18a4198",
    "group": [
      {
        "id": "331676df-b8fd-4492-82ed-02b927f8dd80",
        "name": "group1"
      }
    ]
  },
  "labels": {
    "identity_source": "azure-1"
  }
}

This is the Entity dataset.

{
    "@timestamp": "2026-07-29T09:35:46.444Z",
    "agent": {
        "ephemeral_id": "ba88dec0-f6de-48e7-9946-8719b6f0cd06",
        "id": "a08acbcd-2d58-4e0f-b909-c2e369278788",
        "name": "elastic-agent-96580",
        "type": "filebeat",
        "version": "9.4.4"
    },
    "data_stream": {
        "dataset": "entityanalytics_entra_id.entity",
        "namespace": "93376",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "a08acbcd-2d58-4e0f-b909-c2e369278788",
        "snapshot": false,
        "version": "9.4.4"
    },
    "event": {
        "action": "started",
        "agent_id_status": "verified",
        "dataset": "entityanalytics_entra_id.entity",
        "ingested": "2026-07-29T09:35:49Z",
        "kind": "asset",
        "module": "entityanalytics_entra_id",
        "original": "{\"input\":{\"type\":\"entity-analytics\"},\"agent\":{\"name\":\"elastic-agent-96580\",\"id\":\"a08acbcd-2d58-4e0f-b909-c2e369278788\",\"type\":\"filebeat\",\"ephemeral_id\":\"ba88dec0-f6de-48e7-9946-8719b6f0cd06\",\"version\":\"9.4.4\"},\"@timestamp\":\"2026-07-29T09:35:46.444Z\",\"ecs\":{\"version\":\"8.11.0\"},\"data_stream\":{\"namespace\":\"93376\",\"type\":\"logs\",\"dataset\":\"entityanalytics_entra_id.entity\"},\"elastic_agent\":{\"id\":\"a08acbcd-2d58-4e0f-b909-c2e369278788\",\"version\":\"9.4.4\",\"snapshot\":false},\"event\":{\"start\":\"2026-07-29T09:35:46.444Z\",\"action\":\"started\",\"dataset\":\"entityanalytics_entra_id.entity\"},\"labels\":{\"identity_source\":\"entity-analytics-entityanalytics_entra_id.entity-c223753b-856d-4a4c-94e8-68670d6b3985\"},\"tags\":[\"all-entities\",\"preserve_original_event\",\"forwarded\",\"entityanalytics_entra_id-entity\"],\"_version_type\":\"internal\",\"_index\":\"logs-entityanalytics_entra_id.entity-93376\",\"_id\":null,\"_version\":-4}",
        "provider": "Microsoft Entra ID",
        "start": "2026-07-29T09:35:46.444Z"
    },
    "input": {
        "type": "entity-analytics"
    },
    "labels": {
        "identity_source": "entity-analytics-entityanalytics_entra_id.entity-c223753b-856d-4a4c-94e8-68670d6b3985"
    },
    "tags": [
        "all-entities",
        "preserve_original_event",
        "forwarded",
        "entityanalytics_entra_id-entity"
    ]
}