Forum Discussion
Entra ID protection - Integration into Defender XDR
Hi StephanGee,
If you’re utilizing Microsoft Sentinel and the XDR Unified security operations portal it looks like there’s an Entra ID Protection data connector (solution) for Sentinel which could bring that data into your XDR dashboard: Entra ID Protection - Sentinel Community Hub Solution
Best,Dylan
Hi StephanGee
I just wanted to add, that there is no need for the sentinel integration to get this into your Defender portal.
The detection source is already there, it is shown as "AAD Identity Protection" which can be found with the filter under alerts and incidents.
- Currently we are not seeing any Microsoft Entra ID Protection alerts in defender portal. But we can see Anonymous IP address in Microsoft Entra admin center"
In Settings -> Microsoft Defender XDR ->Alert service settings -> Microsoft Entra ID protection -> "All Alerts" is already selected.
How to get "Microsoft Entra ID Protection" alerts in Defender portal? Do we have to do any other configuration?
- We are still having the issue. The last days we did not even get a mail notification if a risky user was detected.
This must be fixed somehow.
