--- title: Azure Microsoft Sentinel Integration description: Microsoft Sentinel is a scalable, cloud-native, security information event management (SIEM). Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. --- [Skip to content](https://content.sirp.io/knowledge-base/azure-microsoft-sentinel-integration-help-center-sirp#main-content) English Show submenu for translations [Customer portal](https://content.sirp.io/customer-portal?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png)](https://sirp.io/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://content.sirp.io/customer-portal) - [Contact us](https://content.sirp.io/customer-portal/new) [Contact us](https://content.sirp.io/customer-portal/new?hsLang=en) What would you like to automate today? - There are no suggestions because the search field is empty. 1. [SIRP Help Center](https://content.sirp.io/knowledge-base?hsLang=en) 2. [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) # Azure Microsoft Sentinel Integration ### About Microsoft Sentinel Microsoft Sentinel is a scalable, cloud-native security information event management (SIEM). Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise, providing a single solution for alert detection, threat visibility, proactive hunting, and threat response. Microsoft Sentinel and SIRP integration allow SOC teams to ingest incidents, alerts, and entity data from Microsoft Sentinel and accelerate threat identification and investigation. Bidirectional integration between SIRP SOAR and Microsoft Sentinel enables SOC teams to orchestrate and automate response actions through playbooks. It cuts back the detection, investigation, and response time dramatically. ### Supported Actions SIRP’s Microsoft Sentinel integration app allows you to execute the following actions: | **S.no** | **Action** | **Description** | | --- | --- | --- | | 1 | Get Incidents | Ingest Incidents from Microsoft Sentinel | | 2 | Get Incident Alerts | Fetch Alerts of a particular Incident from Microsoft Sentinel | | 3 | Get Incident Entities | Fetch artifacts of a particular Incident from Microsoft Sentinel | | 4 | Update Classification | Update Incident classification in Microsoft Sentinel | | 5 | Update Severity | Update the Incident's severity in Microsoft Sentinel | | 6 | Update Status | Update Incident's status in Microsoft Sentinel | Network Prerequisites - Connectivity on port **443** at domain **management.azure.com** ### Enable and Configure Microsoft Sentinel **1. Launch Azure CLI** Open Azure CLI installed on your machine or go to [https://shell.azure.com](https://shell.azure.com) which allows you to execute all your Azure CLI commands in your browser without having to install locally. ### 2. Get Subscription ID Run the following command in your Azure CLI **\>** `az account show --query id -o tsv` ### 3. Create a Service Principal A service principal is an Azure account that allows you to perform actions on Azure resources. It is an identity created for use with applications, hosted services, and automated tools to access Azure resources. In this case, it is to be used to generate the tokens that SIRP needs to authenticate with the Azure Rest APIs. [Click here to learn more about Service Principals](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli?toc=%2Fazure%2Fazure-resource-manager%2Ftoc.json&view=azure-cli-latest). To create a service principal in your tenant run the following command in your Azure CLI **\> `az ad sp create-for-rbac` --role contributor --scopes /subscriptions/\/resourceGroups/\** [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/074.png)](https://downloads.intercomcdn.com/i/o/482411414/6402676dd2f6410396ff677e/074.png?expires=1752237000&signature=c0f5dc30835003ea5aab625889c738cf15ce88ba20362a39d7ae0baf07abf88a&req=cCglEsh%2FmYBbFb4f3HP0gKONxvJCB0GyijQEYv%2Fbjoy0v6UGK0IUoguhIm9h%0AuJJ%2Bk0V2Fv9%2F1Nkz0A%3D%3D%0A) ### **4. Get the Resource Group Name** In Azure, you logically group related resources to deploy, manage and maintain them as a single entity. The **resource group** is a container that holds these related resources for an Azure solution. These resources can be virtual machines, storage accounts, virtual networks, web apps, databases, and/or database servers. [Click here to learn more about Azure Resource Groups](https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal). A resource group is the first thing that is created while setting up Azure Sentinel. To open fine your resource by resource group: 1. Sign in to the [Azure portal](https://portal.azure.com/) 2. In the left pane, select **Resource groups** 3. Copy the name of the resource group in which you created the Log Analytics workspace. ### **5. Get Log Analytics Workspace Name** Log Analytics is a service that helps you collect and analyze data generated by resources in your cloud and on-premises environments. ​ Log Analytics workspace is the environment for Azure Monitor log data. Each workspace has its own data repository and configuration, and data sources and solutions are configured to store their data in a particular workspace. A workspace has a unique workspace ID and resource ID. You can reuse the same workspace name when in different resource groups. Azure Sentinel runs on the Log Analytics workspace and uses it to store all security-related data. To find your workspace name, In the [Azure portal](https://portal.azure.com/), click **All services**. In the list of resources, type **Log Analytics**. As you begin typing, the list filters based on your input. Select **Log Analytics workspaces**. Find and copy the name of your workspace. ​ ​ ### Enable the Azure Sentinel App in SIRP 1. First, log in to SIRP, then go to **Apps** from the left navigation bar. 2. Locate the app named **Azure Sentinel.** 3. **Enable** the app by clicking on the toggle button under the Status Column. [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-54-54-5720-AM.png)](https://downloads.intercomcdn.com/i/o/599861382/cd2cc20a4edebe22e6d4a62b/image.png?expires=1752237000&signature=68aba3722e15c0a8c898299132c6684106f1022640ecfaf8d2f570ad11937ac1&req=cSkuHs9%2FnoldFb4f3HP0gA7Mm%2F1lFbyE0eE0ganHVBvxfbjpeqhSVBbzLJBz%0ACATDmwvvJs6ar4WPbA%3D%3D%0A) 1. Once you enable the App, click the **configure** option to integrate SIRP with Azure Sentinel. 2. Add the following details and click **Save**: | **Parameter** | **Value** | | --- | --- | | **Host** | leave it as it is [management.azure.com](https://management.azure.com/) | | **APP-ID** | **`appId`** from the service principal creation output above | | **APP-Secret** | **`password`** from the service principal creation output above | | **Tenant-ID** | **`tenantId`** from the service principal creation output above | | **Subscription-ID** | **`subscriptionId`**from the get subscription output above | | **Resource-Group** | Resource group name copied from the **Get Resource Group** section above | | **Workspace-Name** | Workspace name copied from the **Get Log Analytics Workspace Name** section above | [![](https://content.sirp.io/hubfs/Knowledge%20Base%20Import/image-Jul-11-2025-11-54-56-7225-AM.png)](https://downloads.intercomcdn.com/i/o/485384026/46bb23b1903a2f7d3ac4e520/image.png?expires=1752237000&signature=6b6b7735f809ca155255d34329c1cc63a2910387b523499ac9554475c8c35cca&req=cCgiFcF6nYNZFb4f3HP0gBxtCBE%2Fw%2BmvGNQ%2FPC%2BgjGpFKV8IG1kBRJyEjDKp%0AHziGrvGdkWsY2g%2BF5Q%3D%3D%0A) - [SIRP Community](https://content.sirp.io/knowledge-base/sirp-community?hsLang=en) - [Playbook Guide](https://content.sirp.io/knowledge-base/playbook-guide?hsLang=en) - [User Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#main-content) - [IM Guide](https://content.sirp.io/knowledge-base/user-guide?hsLang=en#im-guide) - [Admin Guide](https://content.sirp.io/knowledge-base/admin-guide?hsLang=en) - [Integration Guide](https://content.sirp.io/knowledge-base/integration-guide?hsLang=en) - [Release Notes](https://content.sirp.io/knowledge-base/release-notes?hsLang=en) - [Add on Apps](https://content.sirp.io/knowledge-base/add-on-apps?hsLang=en) - [Architecture](https://content.sirp.io/knowledge-base/architecture?hsLang=en) - [Use Cases](https://content.sirp.io/knowledge-base/use-cases?hsLang=en) [![SIRP-Logo-4c-KO](https://content.sirp.io/hs-fs/hubfs/SIRP-Logo-4c-KO.png?width=200&height=90&name=SIRP-Logo-4c-KO.png "SIRP-Logo-4c-KO")](https://sirp.io) ### Global Headquarter ##### United States 7735 Old Georgetown Rd, Suite 510 Bethesda, MD 20814 [+1 888 701 9252](tel:+18887019252) [mailto:email@email.com](mailto:email@email.com) Copyright © 2025, SIRP Labs Inc