---
title: Azure Sentinel
slug: authentication-guides/azure-sentinel
docTags: 
createdAt: 2026-01-13T09:25:38.430Z
---

# Introduction

This guide tells you how to authenticate the Microsoft Azure Sentinel connector in Swimlane using OAuth 2.0 Client Credentials.
You will create an Azure app, assign required permissions, collect required identifiers, and configure the connector in Swimlane. 

# Prerequisites

## Azure Access Requirements

You must have Azure permissions to:

- Register applications under Azure Active Directory
- Assign API permissions
- View subscription and workplace information
- Assign roles on the Azure Sentinel workspace

## Required Credentials 

During setup, you will collect:

- Client ID
- Client Secret
- Tenant ID
- Token URL
- Host URL
- Subscription ID
- Resource Group Name
- Workspace Name
- Workspace ID

### Token URLs

| **Action Type**     | **Token URL**                                                          |
| ------------------- | ---------------------------------------------------------------------- |
| Log Analytics Query | https\://login.microsoftonline.com/{tenant\_id}/oauth2/token      |
| All other Actions   | https\://login.microsoftonline.com/{tenant\_id}/oauth2/v2.0/token |

### Host URLs

| **Action Type**     | **Host URL**                         |
| ------------------- | ------------------------------------ |
| Log Analytics Query | https\://api.loganalytics.azure.com/ |
| All other Actions   | https\://management.azure.com/       |

# Azure Setup

Take the following steps to register the application:

1. Navigate to Azure Portal > Azure Active Directory > App Registrations.
2. Click **New Registration**.
3. Enter an application name.
4. Choose *Accounts in this organizational directory only*.
5. Click **Register**.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/ZV7usweNIhN47LdZMRIYy_image.png)

Take the following steps to assign API permissions:

1. Open **API Permissions tab**
2. Click **Add a permission**
3. Add the following permissions:
   - Microsoft Graph/SecurityEvents.ReadWrite.All
   - WindowsDefenderATP/Alert.ReadWrite.All

::Image[]{src="https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/VxSVT5JWNOZV18tC7jtTL-20260121-055623.png" size="82" width="1356" height="892" position="center" showCaption="false"}

Take the following steps to generate a Client Secret:

1. Navigate to Certificates & Secrets.
2. Click **New client secret**.
3. Add description and expiration.
4. Copy and save the value. This saved value is Client Secret.

Take the following steps to collect required Identifiers:

1. From **App Registration**>**Overview**, copy:
   - Client ID
   - Tenant ID
2. From the Azure workspace sections, copy:
   - Resource Group Name
   - Subscription ID
   - Workspace Name
   - Workspace ID

# Connector configuration in Swimlane

1. Log in to Turbine.
2. From the left-hand navigation pane, click **ORCHESTRATION** and click **Assets**.
   Asset homepage opens.
3. Click the **plus** icon to open the Configure your Connector Asset window.
4. Select Microsoft Azure Sentinel from the Asset type list.
5. Fill in the **Asset Settings **and **Asset Input** as shown:

| **Field**      | **Description**                        | **Required/Optional** |
| -------------- | -------------------------------------- | --------------------- |
| url            | Host URL based on action type          | Required              |
| token\_url     | Token URL with Tenant ID included      | Required              |
| client\_id     | Client ID from Azure                   | Required              |
| client\_secret | Client Secret from Azure               | Required              |
| scope          | Optional, leave blank unless specified | Optional              |
| verify\_ssl    | Enable/Disable SSL Verification        | Optional              |
| http\_proxy    | Optional proxy configuration           | Optional              |

Fields with \* marks are required.

![](https://api.archbee.com/api/optimize/n8uUzk0MM4uC57-zlHNtY/8q0trgRAEwnOgq3J1Wync-20260121-060146.png)

6. Click **Create**.

# Troubleshooting

If you encounter a 403 error:

- Ensure the Azure app is added to the Sentinel workspace.
- Assign Contributor role.

You have successfully authenticated the Azure Sentinel Connector in Swimlane.