Dropzone AI Documentation
WebsiteTest Drive
  • Dropzone Documentation
  • Overview
    • Alert Sources
    • Data Sources
    • Communicators
    • On-prem Support - Dropzone Connector
    • Interactive Chat
    • Metrics Guide
  • Dropzone Administraton
    • Team Admin
      • Google Workspace SAML
      • Okta SAML
  • Dropzone Integrations
    • Alert + Data Source Integrations
      • Amazon Web Services (AWS)
        • Cross-Account Access via CloudFormation
        • Cross-Account Access via Console
      • CrowdStrike
      • Datadog
      • Elasticsearch
      • Google Workspace
      • Google GCP
      • Jira
      • Microsoft (MS 365 etc)
        • Microsoft 365 / Microsoft Defender
        • Microsoft Sentinel
        • Microsoft 365 Exchange Online Management
      • Palo Alto Networks Firewall
      • Panther
      • QRadar
      • SentinelOne
      • Splunk
      • Sumo Logic
    • Alert Integrations
      • Gem
      • ServiceNow
    • Communicators
      • Microsoft Teams
      • Slack Communicator
    • Data Source Integrations
      • AbuseIPDB
      • Active Directory (LDAP)
      • Archive Inspector
      • Blocklist.de
      • CAPA
      • Censys
      • Crowdstrike Falcon Intelligence
      • DNSResolver
      • Dropzone URL Sandbox
      • EchoTrail
      • File
      • GreyNoise
      • Hybrid Analysis
      • Host.io
      • IPInfo.io
      • IPQualityScore
      • MalwareBazaar
      • Nuclei
      • NVD
      • Okta
      • oletools
      • OpenSSL Sign Code
      • PDF Analysis
      • Perplexity AI
      • PhishTank
      • Shodan
      • TShark
      • QRadar
      • UnshortenMe
      • URLhaus
      • Urlscan.io
      • VirusTotal
      • Vision
      • WHOIS
      • YARAify
Powered by GitBook
On this page
  • Microsoft Integrations
  • Integration Overview
  • Register a New Application in Microsoft Entra Admin Center
  • Client ID, Tenant ID, and Client Secret
  • Set Application Permissions

Was this helpful?

  1. Dropzone Integrations
  2. Alert + Data Source Integrations

Microsoft (MS 365 etc)

PreviousJiraNextMicrosoft 365 / Microsoft Defender

Last updated 4 days ago

Was this helpful?

Microsoft Integrations

Dropzone AI integrates with , as well as . This document serves as an overview for performing certain steps of their integration. Further information on how to perform the integrations for Microsoft 365/Defender and Microsoft Sentinel can be found on their separate pages.

Integration Overview

To enable these integrations you will perform the following actions:

  • Register a new application in Microsoft Entra Admin Center

  • Locate your Client ID, Tenant ID, and create a Client Secret

  • Assign the necessary API permissions to the application

Register a New Application in Microsoft Entra Admin Center

Microsoft's documentation for registering an application is available at

  • Sign into as an administrator

  • In the left sidebar, navigate to Identity > Applications > App Registrations

  • Click "New Registration"

  • Name the new application something memorable, such as "Dropzone AI"

  • Under "Supported account types," select "Accounts in this organizational directory only (Single tenant)"

  • Leave the "Redirect URI (optional)" section blank

  • Click "Register"

Client ID, Tenant ID, and Client Secret

Once the application has been created, it will redirect you to the application's Overview page.

  • In the Overview page, copy the Application ID and the Directory ID for use later in the Dropzone UI, where they are called "Client ID" and "Tenant ID" respectively

  • Next to "Client credentials," click "Add a certificate or secret"

  • Under the Client secrets heading, click "New client secret"

  • Enter a description for the client secret, such as "Dropzone AI Integration Secret," and choose an appropriate expiration date. Click "Add"

Your Dropzone integration will stop working when the client secret expires. Consider setting a calendar reminder to update the key prior to expiration. For convenience's sake, we recommend picking a longer expiration date, to limit the number of times the client secret must be updated.

  • Under "Value," copy the Client Secret Value for use later in the Dropzone UI, where it is called "Client Secret"

This value is not shown after you leave this page - be sure to record it immediately.

Set Application Permissions

  • In the application's sidebar, navigate to Manage > API permissions

  • Click "Add a permission"

  • In the search bar, input the desired API, such as "Microsoft Graph" and select it

  • Click "Application permissions"

  • In the search bar, input the name of the permission your integration requires, then check the box next to it. Continue to do so until all permissions have been added, then click "Add permissions"

Once back in the Application API permissions page, you should now see the permissions, such as the following:

  • Click "Grant admin consent for [mycompany.net]"

  • Click "Yes"

You should now see all the required permissions listed with a green check mark

Microsoft's documentation for creating client credentials for an application is available

Depending on the integration you are performing, you will need to add different permissions. See ( or for more details). For the purpose of this overview, the Microsoft Graph API has been used.

here
Microsoft 365/Microsoft Defender
Microsoft Sentinel
Microsoft 365/Microsoft Defender
Microsoft Sentinel
https://learn.microsoft.com/en-us/graph/auth-register-app-v2
your Entra home
Navigate to App Registrations
Registering the Dropzone AI Application
Copy the integration details
Add a certificate or secret
Create a new client secret
Add client secret
Copy the Client Secret Value
Navigate to API permissions
Add a permission
Select Microsoft Graph
For example, add the SecurityEvents.Read.All permission
(Example permissions)
Grant admin consent
Grant admin consent
(Completed permissions)