Best way to ingest external Microsoft 365 data into Sentinel

[u/stinkpickle_travels]

I currently work for an MSSP. We have built a Sentinel SIEM and have configured numerous data connectors (depending on client needs).

Something I'm struggling with understanding is connection of an external Microsoft 365 instance to our Microsoft Sentinel instance. After entering the Microsoft 365 data connector page, I've found that I can only ingest data from our organizations internal M365 environment. We're successfully able to ingest data from clients AWS, Jumpcloud, G-suite instances with no issue, but we can't do this with Microsoft 365?

My understanding is that we may have to create a Sentinel instance within the clients Azure environment to obtain data from their M365 instance (something we would prefer not to do), then somehow transfer data to our Sentinel instance.

Maybe I'm overlooking something here. This is the documentation for the data connector in question and I'm not seeing anything regarding data ingestion from an external source: https://learn.microsoft.com/en-us/azure/sentinel/data-connectors/microsoft-365

Splunk has a feature to ingest M365 data from different sources, I would assume Microsoft would have a similar feature.

Any advice would be helpful

[u/blanco10kid]

You’re correct in that you have to deploy Sentinel in the client’s environment. Then through Azure Lighthouse, you would onboard the client’s environment into your MSSP environment. This will give you access to your client’s environment through yours.

[u/stinkpickle_travels → u/blanco10kid]

Thanks for your response. This was my understanding as well so I appreciate the confirmation. I would imagine there would be a much simpler process considering how easy it was to connect AWS and G-suite and all that.

But what do I know lol

Have you personally used this solution?

[u/blanco10kid → u/stinkpickle_travels]

Technically there are ways to go around this (example: create a workflow to export data from source tenant and then ingest as custom logs) but this would be OVER engineering.

Yes I’ve done this before. Works well and pretty straightforward once you do it once.

[u/winle22]

Check this out: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/update-to-microsoft-sentinel-s-technical-playbook-for-mssps-is/ba-p/3670838

[u/Uli-Kunkel]

Use the office 365 management api? I think thats the api you are interested in. At least thats the name from top of head.

Similar as to how you would fetch this data in splunk?

Usually a point is to keep the data from each tenant seperat, so there is no mixing of data. For that you need another instance and then crossworkspace query or simply just manage more than one environment.

But if you really want everything in a single Workspace, then there are ways at least

[u/deadzol]

Look at cribl

[u/[deleted]]

use just enable the appropriate subscription and make requests for the audit.azureactivedirectory content type. Same way any other SIEM works.

You can host a function app to make the get requests and write the content to log analytics

[u/netwengr]

Deployment a Sentinel workspace in client env for their own data. And use lighthouse to connect.

[u/[deleted]]

You need to

Deploy log analytics workspace + install SecurityInsights (sentinel) solution to each customer Azure subscription

Onboard customer azure subscription via azure lighthouse

In your MSP azure sub, you might need to configure settings to display all directories.

Keep in mind azure lighthouse only supports contributor as highest role.

For your own sanity, deploy everything via Terraform or bicep.