Integrate Microsoft Entra ID with Google SecOps

This document provides guidance on how to integrate Microsoft Entra ID with Google Security Operations (Google SecOps).

Integration version: 17.0

This integration uses one or more open source components. You can download a zipped copy of the full source code of this integration from the Cloud Storage bucket .

Use cases

Integrating Microsoft Entra ID with Google SecOps can help you solve the following use cases:

• User account management:use the Google SecOps capabilities to automate the disabling and enabling of user accounts in Microsoft Entra ID based on security events, such as suspected compromise or employee offboarding.

• Password reset:use the Google SecOps capabilities to orchestrate password resets for compromised accounts or users locked out of their accounts. Resetting passwords can help you streamline the password recovery process and reduce help desk tickets.

• Group management:use the Google SecOps capabilities to automate creating, modificating, and deleting Microsoft Entra ID groups.

• Conditional access policy enforcement:use the Microsoft Entra ID conditional access policies within Google SecOps playbooks to dynamically control access based on context and allow for granular control over access to resources based on factors like location, device, and user risk.

• Security alerting and incident response:integrate the Microsoft Entra ID security alerts into Google SecOps to automate incident response workflows.

Before you begin

Before configuring the integration in the Google SecOps platform, complete the following steps:

1. Configure network access.

2. Create the Microsoft Entra app.

3. Configure the API permissions for your app.

4. Create a client secret.

Configure network access

To enable the API access from Google SecOps to Microsoft Entra ID, allow the traffic over the 443 port.

Create Microsoft Entra application

1. Sign in to the Azure portal as a user administrator or a password administrator.

2. Select Microsoft Entra ID.

3. Go to App registrations > New registration.

4. Enter the name of the application.

5. Click Register.

6. Save the Application (client) IDand Directory (tenant) IDvalues to use them later when configuring the integration parameters .

Configure API permissions

1. Go to API Permissions > Add a permission.

2. Select Microsoft Graph > Application permissions.

3. In the Select Permissionssection, select the following permissions:

   • Directory.Read.All
   • Directory.ReadWrite.All
   • Group.ReadWrite.All

   • User.ReadWrite.All

     These permissions are not sufficient to run the password-related actions. To run the Force Password Update and Reset User Password actions, assign the Password Administrator role to your application using the Roles and administratorssearch in Microsoft Entra ID.

     For more details about permissions, see Microsoft Graph permissions reference and Sensitive actions .

4. Click Add permissions.

5. Click Grant admin consent for YOUR_ORGANIZATION_NAME .

   When the Grant admin consent confirmationdialog appears, click Yes.

Create client secret

1. Navigate to Certificates and secrets > New client secret.

2. Provide a description for a client secret and set its expiration deadline.

3. Click Add.

4. Save the value of the client secret (not the secret ID) to use it as the Client Secret parameter value when configuring the integration. The client secret value is only displayed once.

Integrate Microsoft Entra ID with Google SecOps

The Microsoft Entra ID integration requires the following parameters:

For instructions about how to configure an integration in Google SecOps, see Configure integrations .

You can make changes at a later stage if needed. After you configure an integration instance, you can use it in playbooks. For more information about configuring and supporting multiple instances, see Supporting multiple instances .

Actions

For more information about actions, see Respond to pending actions from your workdesk and Perform a manual action .

Add User to a Group

Use the Add User to a Groupaction to add a user to the specific Microsoft Entra ID group. This action expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps User entity.

Action inputs

The Add User to a Groupaction requires the following parameters:

Action outputs

The Add User to a Groupaction provides the following outputs:

Output messages

The Add User to a Groupaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Add User to a Groupaction:

Disable Account

Use the Disable Accountaction to disable an account in Microsoft Entra ID. This action expects you to configure the User entity in the username@domain format.

To run the Disable Accountaction, grant administrative privileges to the Microsoft Entra ID account that you use in the integration.

This action runs on the Google SecOps User entity.

Configure additional permissions

The Disable Accountaction requires you to additionally configure the following API permission for the application:

• User.EnableDisableAccount.All

For guidance on how to configure API permissions in Microsoft Entra ID, see the Configure API permissions section of this document.

Action inputs

None.

Action outputs

The Disable Accountaction provides the following outputs:

Output messages

The Disable Accountaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Disable Accountaction:

Enable Account

Use the Enable Accountaction to enable an account in Microsoft Entra ID. This action expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps User entity.

Configure additional permissions

The Enable Accountaction requires you to additionally configure the following API permission for the application:

• User.EnableDisableAccount.All

For guidance on how to configure API permissions in Microsoft Entra ID, see the Configure API permissions section of this document.

Action inputs

None.

Action outputs

The Enable Accountaction provides the following outputs:

Output messages

The Enable Accountaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enable Accountaction:

Enrich Host

Use the Enrich Hostaction to enrich the Google SecOps Host entity with information from Microsoft Entra ID. This action finds a match for a provided Host entity using on the device displayName field in Microsoft Entra ID.

This action runs on the Google SecOps Host entity.

Action inputs

None.

Action outputs

The Enrich Hostaction provides the following outputs:

Entity enrichment table

The Enrich Hostaction supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the Enrich Hostaction:

  [ 
  
 { 
  
 "EntityResult" 
 : 
  
 { 
  
 "deletedDateTime" 
 : 
  
 "1234569" 
 , 
  
 "complianceExpirationDateTime" 
 : 
  
 "1234567" 
 , 
  
 "profileType" 
 : 
  
 "RegisteredDevice" 
 , 
  
 "key" 
 : 
  
 "007" 
 , 
  
 "if" 
 : 
 "889922-aaaa-123123" 
  
 }, 
  
 "Entity" 
 : 
  
 "us-lt-v13001" 
  
 } 
 ] 
 

Output messages

The Enrich Hostaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enrich Hostaction:

Enrich User

Use the Enrich Useraction to enrich the Google SecOps User entity with information from Microsoft Entra ID. This action expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps Host entity.

Action inputs

None.

Action outputs

The Enrich Useraction provides the following outputs:

Entity enrichment table

The Enrich Useraction supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the Enrich Useraction:

  [ 
  
 { 
  
 "EntityResult" 
 : 
  
 { 
  
 "displayName" 
 : 
  
 "Test User" 
 , 
  
 "mobilePhone" 
 : 
  
 "(800) 555-0175" 
 , 
  
 "preferredLanguage" 
 : 
  
 "English" 
 , 
  
 "jobTitle" 
 : 
  
 "Engineer" 
 , 
  
 "userPrincipalName" 
 : 
 "ser@example.com" 
  
 }, 
  
 "Entity" 
 : 
  
 "user@example.com" 
  
 } 
 ] 
 

Output messages

The Enrich Useraction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Enrich Useraction:

Force Password Update

Use the Force Password Updateaction to force a password update for the user. This action requires the user to change their password on the next sign-in attempt.

The Force Password Updateaction expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps User entity.

Configure additional permissions

The Force Password Updateaction requires you to additionally configure the following API permission for the application:

• User-PasswordProfile.ReadWrite.All

For guidance on how to configure API permissions in Microsoft Entra ID, see the Configure API permissions section of this document.

Assign a role to your application

The Force Password Updateaction requires you to assign the Password Administrator role to your application.

To assign the Password Administrator role to your application, complete the following steps:

1. Sign in to the Azure portal using your Microsoft account.
2. In Microsoft Entra ID, search for Roles and administrators.
3. Select or search for the Password Administrator role from the list.
4. Click Add Assignment.
5. Select an account (member) that you use in the integration and click Next.
6. Enter justification for assigning a role.
7. Click Assign.

Action inputs

None.

Action outputs

The Force Password Updateaction provides the following outputs:

Output messages

The Force Password Updateaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Force Password Updateaction:

Get Manager Contact Details

Use the Get Manager Contact Detailsaction to obtain the manager contact details for the user.

The Get Manager Contact Detailsaction expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps User entity.

Action inputs

None.

Action outputs

The Get Manager Contact Detailsaction provides the following outputs:

Case wall table

The Get Manager Contact Detailsaction can return the following table in Google SecOps:

Table name: Manager contact

Columns:

• Name
• Phone number

Entity enrichment table

The Get Manager Contact Detailsaction supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the Get Manager Contact Detailsaction:

  [ 
  
 { 
  
 "EntityResult" 
 : 
  
 { 
  
 "displayName" 
 : 
  
 "manager@example.com" 
 , 
  
 "mobilePhone" 
 : 
  
 "(800) 555-0175" 
 , 
  
 "@odata.context" 
 : 
  
 "graph.microsoft.com" 
  
 }, 
  
 "Entity" 
 : 
  
 "user@example.com" 
  
 } 
 ] 
 

Output messages

The Get Manager Contact Detailsaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Get Manager Contact Detailsaction:

Is User in Group

Use the Is User in Groupaction to check if the user has membership in a specific Microsoft Entra ID group. This action expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps User entity.

Action inputs

The Is User in Groupaction requires the following parameters:

Action outputs

The Is User in Groupaction provides the following outputs:

JSON result

The following example shows the JSON result output received when using the Is User in Groupaction:

  [ 
  
 { 
  
 "EntityResult" 
 : 
  
 "true" 
 , 
  
 "Entity" 
 : 
  
 "user@example.com" 
  
 } 
 ] 
 

Output messages

The Is User in Groupaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Is User in Groupaction:

List Groups

Use the List Groupsaction to list Microsoft Entra ID groups using the specified search criteria.

For the List Groupsaction, filtering works with the Name field.

This action doesn't run on Google SecOps entities.

Action inputs

The List Groupsaction requires the following parameters:

Action outputs

The List Groupsaction provides the following outputs:

Case wall table

The List Groupsaction can return the following table in Google SecOps:

Table name: Groups

Columns:

• Name
• ID
• Description
• Mail
• Created Time
• Group Type

Entity enrichment table

The List Groupsaction supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the List Groupsaction:

  [ 
  
 { 
  
 "Group Type" 
 : 
  
 "managed" 
 , 
  
 "Id" 
 : 
  
 " ID 
" 
 , 
  
 "Name" 
 : 
  
 "Example" 
 , 
  
 "Description" 
 : 
  
 "Example" 
 , 
  
 "Created Time" 
 : 
 "2019-10-24T19:10:18Z" 
  
 } 
 ] 
 

Output messages

The List Groupsaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the List Groupsaction:

List Members in the Group

Use the List Members in the Groupaction to list members in the specified Microsoft Entra ID group.

The filtering logic works based on the Filter Key parameter value.

This action doesn't run on Google SecOps entities.

Action inputs

The List Members in the Groupaction requires the following parameters:

Action outputs

The List Members in the Groupaction provides the following outputs:

Case wall table

The List Members in the Groupaction can return the following table in Google SecOps:

Table name: Available members of the group

Columns:

• ID
• User Principal Name
• Display Name
• Surname
• Given Name
• Mail
• Job Title
• Business Phones
• Mobile Phone
• Office Location
• Preferred Language

JSON result

The following example shows the JSON result output received when using the List Members in the Groupaction:

  { 
  
 "@odata.context" 
 : 
  
 "https://graph.microsoft.com/v1.0/$metadata#Collection(Edm.String)" 
 , 
  
 "value" 
 : 
  
 [ 
  
 " ID 
" 
 , 
  
 " ID 
" 
 , 
  
 " ID 
" 
 , 
  
 ] 
 } 
 

Output messages

The List Members in the Groupaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the List Members in the Groupaction:

List User's Groups Membership

Use the List User's Groups Membershipaction to list the Microsoft Entra ID groups of which the user is a member.

You can provide the username as an entity or an action input parameter. If you configure the username as both the entity and the input parameter, the action uses the input parameter.

To configure the username, follow the username@domain format.

This action runs on the Google SecOps Username entity.

Action inputs

The List User's Groups Membershipaction requires the following parameters:

Action outputs

The List User's Groups Membershipaction provides the following outputs:

Case wall table

The List User's Groups Membershipaction can return the following table in Google SecOps:

Table name: Group Memberships

Columns:

• ID
• Display Name
• Description
• Security Enabled
• Security Identifier
• Created DateTime
• Classification
• Visibility
• Mail
• Mail Enabled
• Mail Nickname

JSON result

The following example shows the JSON result output received when using the List User's Groups Membershipaction:

  { 
  
 "@odata.context" 
 : 
  
 "https://graph.microsoft.com/v1.0/$metadata#Collection(Edm.String)" 
 , 
  
 "value" 
 : 
  
 [ 
  
 " ID 
" 
 , 
  
 " ID 
" 
 , 
  
 " ID 
" 
 , 
  
 ] 
 } 
 

Output messages

The List User's Groups Membershipaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the List User's Groups Membershipaction:

List Users

Use the List Usersaction to list Microsoft Entra ID users using the specified search criteria.

For the List Usersaction, filtering works with the Username ( userPrincipalName ) field.

This action doesn't run on Google SecOps entities.

Action inputs

The List Usersaction requires the following parameters:

Action outputs

The List Usersaction provides the following outputs:

Case wall table

The List Usersaction can return the following table in Google SecOps:

Table name: Users

Columns:

• Name
• Username
• ID
• Given name
• Preferred language
• Mail
• Mobile Phone
• Surname
• Job Title

Entity enrichment table

The List Usersaction supports the following entity enrichment:

JSON result

The following example shows the JSON result output received when using the List Usersaction:

  [ 
  
 { 
  
 "Group Type" 
 : 
  
 "managed" 
 , 
  
 "Id" 
 : 
  
 " ID 
" 
 , 
  
 "Name" 
 : 
  
 "Example" 
 , 
  
 "Description" 
 : 
  
 "Example" 
 , 
  
 "Created Time" 
 : 
 "2019-10-24T19:10:18Z" 
  
 } 
 ] 
 

Output messages

The List Usersaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the List Usersaction:

Ping

Use the Pingaction to test the connectivity to Microsoft Entra ID.

This action runs on all Google SecOps entities.

Action inputs

None.

Action outputs

The Pingaction provides the following outputs:

Output messages

The Pingaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Pingaction:

Remove User from the Group

Use the Remove User from the Groupaction to remove a user from the specified group in Microsoft Entra ID.

You can provide the username as an entity or an action input parameter. If you configure the username as both the entity and the input parameter, the action uses the input parameter.

To configure the username, follow the username@domain format.

This action runs on the Google SecOps Username entity.

Action inputs

The Remove User from the Groupaction requires the following parameters:

Action outputs

The Remove User from the Groupaction provides the following outputs:

Output messages

The Remove User from the Groupaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Remove User from the Groupaction:

Reset User Password

Use the Reset User Passwordaction to reset the user password to the one that you specify in the action. This action requires the user to change their password on the next sign-in attempt.

The Reset User Passwordaction expects you to configure the User entity in the username@domain format.

This action runs on the Google SecOps User entity.

Assign a role to your application

The Reset User Passwordaction requires you to assign the Password Administrator role to your application.

To assign the Password Administrator role to your application, complete the following steps:

1. Sign in to the Azure portal using your Microsoft account.
2. In Microsoft Entra ID, search for Roles and administrators.
3. Select or search for the Password Administrator role from the list.
4. Click Add Assignment.
5. Select an account (member) that you use in the integration and click Next.
6. Enter justification for assigning a role.
7. Click Assign.

Action inputs

The Reset User Passwordaction requires the following parameters:

Action outputs

The Reset User Passwordaction provides the following outputs:

Output messages

The Reset User Passwordaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Reset User Passwordaction:

Revoke User Session

Use the Revoke User Sessionaction to revoke a user session.

This action runs on the following Google SecOps entities:

• Username
• Email Address

Action inputs

None.

Action outputs

The Revoke User Sessionaction provides the following outputs:

JSON result

The following examples show the JSON result outputs received when using the Revoke User Sessionaction:

• If the user exists:

    { 
    
   "@odata.context" 
   : 
    
   "https://graph.microsoft.com/v1.0/$metadata#Edm.Boolean" 
   , 
    
   "value" 
   : 
    
   true 
   } 
   
  

• If the user is not found:

    { 
    
   "error" 
   : 
    
   "User not found." 
   } 
   
  

Output messages

The Revoke User Sessionaction can return the following output messages:

Script result

The following table lists the value for the script result output when using the Revoke User Sessionaction:

Need more help? Get answers from Community members and Google SecOps professionals.