Table of Contents
Overview
Microsoft is retiring the legacy Microsoft Graph security alerts API (/security/alerts) on October 15, 2026. After that date, the legacy API stops returning data. For details, see Microsoft's migration guide.
ARIA is updating the Control and Collections Engine (CCE) to use Microsoft's replacement API (/security/alerts_v2) in CCE 12.2.3 hotfix 4, and will apply that update for you. The replacement API requires additional permissions on the Microsoft Entra ID app registration used by the ADR Azure AD / Office 365 integration. Until those permissions are granted, ADR cannot collect Microsoft security alerts or Identity Protection risk detections.
Who Is Affected
Any customer whose ADR deployment collects logs from Microsoft Entra ID / Office 365 through the Azure AD / Office 365 cloud integration.
Required Action
Complete these steps before October 15, 2026.
- Sign in to the Azure portal and open Microsoft Entra ID > App registrations, then select the app registration you created for ADR.
- Select API permissions > Add a permission > Microsoft Graph > Application permissions, then add:
- SecurityAlert.Read.All
- SecurityIncident.Read.All
- IdentityRiskEvent.Read.All
- Select Add a permission > Office 365 Management APIs > Application permissions, then add:
- ServiceHealth.Read
- Click Grant admin consent, and confirm that every permission shows a green checkmark.
These are the only required permissions missing from earlier versions of our setup instructions. The complete list of permissions is under Verify All Permissions below. For full setup instructions, see Microsoft Azure Configuration.
Verify All Permissions
After completing the required action, confirm that the ADR app registration has every permission below, and that each one shows a green checkmark under API permissions. Required permissions must be present for full log collection. The Intune permissions are optional and add device management details.
Microsoft Graph: Identity & Directory (Microsoft Entra ID)
| Permission | Required | Workload / Scope | Purpose & Usage |
|---|---|---|---|
| AuditLog.Read.All | Required | Microsoft Entra Audit & Sign-in Logs | Reads tenant audit logs, user sign-in logs, and provisioning logs (commonly used by SIEM, XDR, and compliance tooling). |
| Directory.Read.All | Required | Microsoft Entra Directory Objects | Reads all core directory data, including users, groups, domains, administrative units, and tenant configuration. |
| IdentityRiskEvent.Read.All | Required | Entra ID Protection | Reads Identity Protection risk detections (/identityProtection/riskDetections). |
| User.Read (Delegated) | Added by default | Entra User Profile | Allows a signed-in user or application to read the basic profile of the currently authenticated user. Leave it in place. |
| User.Read.All | Required | Entra User Profiles | Reads full user profiles across the entire organization, including department, title, manager, and account status. |
| UserAuthenticationMethod.Read.All | Required | Entra Authentication & MFA | Reads MFA registration details, registered authentication methods (FIDO2, Microsoft Authenticator, SMS, email), and password reset info. |
| Application.Read.All | Required | Entra Enterprise Apps & App Registrations | Reads configuration, permissions, and service principals of all registered applications in the tenant. |
| Device.Read.All | Required | Entra Registered Devices | Reads identity and registration details for devices registered or joined directly to Microsoft Entra ID. |
Microsoft Graph: Device & Endpoint Management (Microsoft Intune)
| Permission | Required | Workload / Scope | Purpose & Usage |
|---|---|---|---|
| DeviceManagementManagedDevices.Read.All | Optional | Microsoft Intune MDM | Reads inventory and telemetry of MDM-managed devices (OS version, serial numbers, compliance state, hardware inventory). |
| DeviceManagementConfiguration.Read.All | Optional | Microsoft Intune Device Config | Reads device configuration profiles, compliance policies, conditional access posture baselines, and setting assignments. |
| DeviceManagementApps.Read.All | Optional | Microsoft Intune Mobile Apps | Reads deployed client application metadata, deployment status, and app protection (MAM) policies. |
| DeviceManagementServiceConfig.Read.All | Optional | Microsoft Intune Tenant Config | Reads tenant-level Intune administration settings, terms and conditions, and enrollment configurations. |
Microsoft Graph: Security & Compliance
| Permission | Required | Workload / Scope | Purpose & Usage |
|---|---|---|---|
| SecurityAlert.Read.All | Required | Microsoft Defender / Security Center | Reads security alerts, incidents, secure score recommendations, and threat intelligence events. |
| SecurityIncident.Read.All | Required | Microsoft Defender XDR Incidents | Reads security incidents and the alerts correlated into them. |
| SecurityEvents.Read.All | Required | Microsoft Graph Security API | Reads security alerts through the /security/alerts endpoint. |
Microsoft Graph: Collaboration, Files & Communication (Microsoft 365 / Exchange / SharePoint)
| Permission | Required | Workload / Scope | Purpose & Usage |
|---|---|---|---|
| Mail.ReadBasic.All | Required | Exchange Online | Reads basic email properties (sender, recipient, subject line, timestamps) across all organization mailboxes without exposing email body contents. |
| MailboxSettings.Read | Required | Exchange Online User Settings | Reads user mailbox configurations such as automatic replies (Out of Office), language/locale, working hours, and time zones. |
| Files.Read.All | Required | OneDrive & SharePoint Files | Reads all files and documents accessible to the organization across OneDrive for Business and SharePoint libraries. |
| Sites.Read.All | Required | SharePoint Online | Reads site collections, lists, document library metadata, and site memberships across SharePoint. |
Office 365 Management APIs
| Permission | Required | Workload / Scope | Purpose & Usage |
|---|---|---|---|
| ActivityFeed.Read | Required | Office 365 Management Activity API | Reads Office 365 audit content: Audit.SharePoint, Audit.Exchange, Audit.General, and Audit.AzureActiveDirectory. |
| ServiceHealth.Read | Required | Microsoft 365 Service Health | Reads real-time service health status, degradation incidents, and maintenance advisories across Microsoft cloud services. |
Licensing
Collecting Identity Protection risk detections requires a Microsoft Entra ID P1 or P2 license. Collecting sign-in logs also requires P1 or P2.
Troubleshooting
If the permissions are missing, the CCE logs HTTP 403 errors from Microsoft Graph such as the following.
- Security alerts: Missing application roles. API required roles: SecurityAlert.Read.All, ... Add SecurityAlert.Read.All and grant admin consent.
- Risk detections: You cannot perform the requested operation, required scopes are missing in the token. Add IdentityRiskEvent.Read.All and grant admin consent.
- Sign-in logs or risk detections: Neither tenant is B2C or tenant doesn't have premium license. The tenant needs a Microsoft Entra ID P1 or P2 license.
If the errors continue after the permissions are granted, contact support.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article