Microsoft Entra ID Entity Analytics

This integration retrieves users and devices, with group memberships from Microsoft Entra ID(formerly Azure Active Directory).

This module has been tested against the Microsoft Graph REST API v1.0.

The Microsoft Entra ID Entity Analytics integration collects two types of data: user and device. While configuring the integration, you can use the Dataset dropdown option to select which type of data you want to collect from Microsoft Entra ID.

Elastic Agent must be installed for standard deployments. For more details, check the Elastic Agent installation instructions.

This integration supports Elastic Managed deployment, where the collection agent runs in Elastic's cloud rather than inside your network. The Microsoft Graph API is a public HTTPS endpoint, so no special connectivity configuration is required.

When using Elastic Managed deployment, the request tracer option is not available because it writes to the agent's local filesystem.

The following Azure API permissions are required:

If you want to collect device properties that are managed by Microsoft Intune, the following additional permission is required:

Without this permission, the following device fields will return null values even if the devices are enrolled in Intune:

• entityanalytics_entra_id.device.is_compliant
• entityanalytics_entra_id.device.is_managed
• entityanalytics_entra_id.device.compliance_expiration_date_time
• entityanalytics_entra_id.device.category
• entityanalytics_entra_id.device.ownership
• entityanalytics_entra_id.device.enrollment_profile_name
• entityanalytics_entra_id.device.mdm_app_id

To collect these fields, enable the Intune Managed Device Properties toggle in the integration settings. When enabled, the integration requests the additional fields from the Graph API automatically.

When the toggle is enabled, do not set select.devices in Custom Options as the two settings will conflict. Other Custom Options settings are unaffected. Users who need a fully custom device field list should use Custom Options directly with the toggle disabled.

For more details on how to set up the necessary App Registration, permission granting, and secret configuration, refer to this guide.

1. In Kibana navigate to Management > Integrations.
2. In the search bar, type Microsoft Entra ID Entity Analytics.
3. Select the Microsoft Entra ID Entity Analytics integration and add it.
4. While adding the integration, add the Tenant ID, Client (Application) ID and Secret (API Key) that you obtained earlier.
5. Save the integration.

The integration periodically contacts Microsoft Entra ID using the Graph API, retrieving updates for users, devices, and groups, updates its internal cache of metadata and group membership information, and ships updated records to Elasticsearch.

Fetching and shipping updates occurs in one of two processes: full synchronizations and incremental updates. Full synchronizations send the entire list of users and devices in state. Incremental updates send only records that changed since the last sync. Changes include metadata updates, additions, deletions, and group membership changes (direct or transitive). By default, full synchronizations occur every 24 hours and incremental updates occur every 15 minutes. These intervals may be customized to suit your use case.

By default this integration uses minimal-state sync, which routes user and device documents directly to the user and device data streams. Existing policies are updated to use minimal-state sync on upgrade.

This integration provides an asset inventory, a point-in-time snapshot of which users and devices exist and their current properties. It does not provide an audit trail of who changed what, or when. If you need to track administrative changes to Entra ID objects (user modifications, deletions, group membership changes by an administrator, etc.), use the Azure integration's audit logs data stream, which collects Entra ID audit logs via Event Hub.

A user document:

{
  "@timestamp": "2022-11-04T09:57:19.786056-05:00",
  "azure_ad": {
    "userPrincipalName": "example.user@example.com",
    "mail": "example.user@example.com",
    "displayName": "Example User",
    "givenName": "Example",
    "surname": "User",
    "jobTitle": "Software Engineer",
    "mobilePhone": "123-555-1000",
    "businessPhones": [
      "123-555-0122"
    ]
  },
  "user": {
    "id": "5ebc6a0f-05b7-4f42-9c8a-682bbc75d0fc",
    "group": [
      {
        "id": "331676df-b8fd-4492-82ed-02b927f8dd80",
        "name": "group1"
      },
      {
        "id": "d140978f-d641-4f01-802f-4ecc1acf8935",
        "name": "group2"
      }
    ]
  },
  "labels": {
    "identity_source": "azure-1"
  }
}
		

A device document:

{
  "@timestamp": "2022-11-04T09:57:19.786056-05:00",
  "azure_ad": {
    "accountEnabled": true,
    "displayName": "DESKTOP-LETW452G",
    "operatingSystem": "Windows",
    "operatingSystemVersion": "10.0.19043.1337",
    "physicalIds": {
      "extensionAttributes": {
        "extensionAttribute1": "BYOD-Device"
      }
    },
    "alternativeSecurityIds": [
      {
        "type": 2,
        "identityProvider": null,
        "key": "DGFSGHSGGTH345A...35DSFH0A"
      }
    ]
  },
  "device": {
    "id": "2fbbb8f9-ff67-4a21-b867-a344d18a4198",
    "group": [
      {
        "id": "331676df-b8fd-4492-82ed-02b927f8dd80",
        "name": "group1"
      }
    ]
  },
  "labels": {
    "identity_source": "azure-1"
  }
}
		

This is the Entity dataset.

{
    "@timestamp": "2026-07-29T09:35:46.444Z",
    "agent": {
        "ephemeral_id": "ba88dec0-f6de-48e7-9946-8719b6f0cd06",
        "id": "a08acbcd-2d58-4e0f-b909-c2e369278788",
        "name": "elastic-agent-96580",
        "type": "filebeat",
        "version": "9.4.4"
    },
    "data_stream": {
        "dataset": "entityanalytics_entra_id.entity",
        "namespace": "93376",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "a08acbcd-2d58-4e0f-b909-c2e369278788",
        "snapshot": false,
        "version": "9.4.4"
    },
    "event": {
        "action": "started",
        "agent_id_status": "verified",
        "dataset": "entityanalytics_entra_id.entity",
        "ingested": "2026-07-29T09:35:49Z",
        "kind": "asset",
        "module": "entityanalytics_entra_id",
        "original": "{\"input\":{\"type\":\"entity-analytics\"},\"agent\":{\"name\":\"elastic-agent-96580\",\"id\":\"a08acbcd-2d58-4e0f-b909-c2e369278788\",\"type\":\"filebeat\",\"ephemeral_id\":\"ba88dec0-f6de-48e7-9946-8719b6f0cd06\",\"version\":\"9.4.4\"},\"@timestamp\":\"2026-07-29T09:35:46.444Z\",\"ecs\":{\"version\":\"8.11.0\"},\"data_stream\":{\"namespace\":\"93376\",\"type\":\"logs\",\"dataset\":\"entityanalytics_entra_id.entity\"},\"elastic_agent\":{\"id\":\"a08acbcd-2d58-4e0f-b909-c2e369278788\",\"version\":\"9.4.4\",\"snapshot\":false},\"event\":{\"start\":\"2026-07-29T09:35:46.444Z\",\"action\":\"started\",\"dataset\":\"entityanalytics_entra_id.entity\"},\"labels\":{\"identity_source\":\"entity-analytics-entityanalytics_entra_id.entity-c223753b-856d-4a4c-94e8-68670d6b3985\"},\"tags\":[\"all-entities\",\"preserve_original_event\",\"forwarded\",\"entityanalytics_entra_id-entity\"],\"_version_type\":\"internal\",\"_index\":\"logs-entityanalytics_entra_id.entity-93376\",\"_id\":null,\"_version\":-4}",
        "provider": "Microsoft Entra ID",
        "start": "2026-07-29T09:35:46.444Z"
    },
    "input": {
        "type": "entity-analytics"
    },
    "labels": {
        "identity_source": "entity-analytics-entityanalytics_entra_id.entity-c223753b-856d-4a4c-94e8-68670d6b3985"
    },
    "tags": [
        "all-entities",
        "preserve_original_event",
        "forwarded",
        "entityanalytics_entra_id-entity"
    ]
}