Skip to main content

​
Getting Started

If you have never used the Microsoft Security UI or corresponding tools, it’s possible you don’t have a service principal defined for the critical Microsoft services, making you unable to connect. If you are unsure, follow the directions below to check if the service principal exists, and if not, how to create it.

​
Check for Service Principal

If you have used the Microsoft Security suite before, you can skip to the below instructions. These actions must be performed by either a Global Administrator, Application Administrator, or Cloud Application Administrator. First you need to install the Azure CLI if you have not already done so. Run the following command on your Windows host: winget install --exact --id Microsoft.AzureCLI (for other OS, see https://learn.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest). The following steps should then be performed:
  1. Sign into you tenant: az login --tenant <customer-domain>.onmicrosoft.com --allow-no-subscriptions
  2. Confirm you’re in the right tenant before creating anything: az account show
  3. Check if a service principal already exists for Microsoft Threat Protection: az ad sp show --id "8ee8fdad-f234-4243-8f3b-15c294843740"
  4. Check if a service principal already exists for Microsoft Defender ATP: az ad sp show --id "fc780465-2017-40d4-a0c5-307022471b92"
  5. Create the Microsoft Threat Protection service principal if it doesn’t exist: az ad sp create --id 8ee8fdad-f234-4243-8f3b-15c294843740
  6. Create the WindowsDefenderATP service principal if it doesn’t exist: az ad sp create --id fc780465-2017-40d4-a0c5-307022471b92
  7. Verify both now exist: az ad sp show --id 8ee8fdad-f234-4243-8f3b-15c294843740 az ad sp show --id fc780465-2017-40d4-a0c5-307022471b92
When you verify there is a service principal for both, move to the next step.

​
How our integration works

We use Microsoft’s OAuth for you to authorize Tier4 to access your Microsoft tenant. This integration allows us to collect directory data (users and endpoints) and security telemetry. If you license a new Microsoft product today or in the future, we’ll autonomously process that data on your behalf.

​
Integrating

To get started, in the Tier4 platform navigate to Integrations and select Microsoft. You will be redirected to the OAuth Consent Page. Once consent is granted, you will be redirected back to the Tier4 platform.
Connect the Microsoft integration using a Global Administrator account. Tier4 validates access to your tenant during setup, and Microsoft commonly withholds that access unless the consent flow is completed by a Global Administrator.