How to enable API access to Microsoft Entra ID (AzureAD)?

This guide provides step-by-step instructions to enable audit log access in Microsoft Entra ID, formerly Azure Active Directory (AzureAD).

Prerequisites

• Administrative access to Microsoft Entra ID.
• An active subscription to Azure.
• Necessary permissions to configure audit logging.

Enabling Audit Log Access in Microsoft Entra ID (AzureAD)

1) Sign in to the Azure Portal

1. Go to Azure Portal - https://portal.azure.com
2. Sign in with your administrative account.

2) Register a new application

1. Azure Portal: Click on Microsoft Entra ID -> Manage on the left sidebar
   -or-
   Microsoft Entra admin center: Click Identity -> Applications on the left sidebar
2. Click App registrations
3. Then click + New registration.
4. Enter a name for your application, e.g. EventSentry or EventSentry Log Download
5. Set Supported account types based on your requirements ("Single Tenant" by default)
6. "Redirect URI" can be left empty
7. Click Register at the bottom.
8. After the application is registered, you will be redirected to the application's overview page.

3) Get the Application (client) ID and Directory (tenant) ID

1. Copy the Application (client) ID. This is your CLIENT_ID.
2. On the same overview page, you will find the Directory (tenant) ID. Copy this value as your TENANT_ID.

4) Create a client secret

1. Click on Certificates & secrets
2. Then under the Client secrets tab click + New client secret.
3. Provide a description for the client secret (e.g. "EventSentry" or "EventSentry Log Download") and set an expiration period. Setting a short expiration period is more secure but will require you to create new secrets when the credentials have expired.
4. Click Add.
5. IMPORTANT: After creating the client secret, copy the Value immediately. This is your CLIENT_SECRET. Note: You won’t be able to copy this secret later, so save it securely.

5) Assign API Permissions

1. On the left sidebar go to API permissions > Add a permission.
2. Select Microsoft Graph.
3. Add delegated permissions: Choose Delegated permissions or Application permissions based on your app's requirements. "Application Permissions" are recommended for most cases.
4. For accessing logs, you need permissions like:
   • AuditLog.Read.All
   • Directory.Read.All
   • Reports.Read.All
5. After adding the necessary permissions, click Grant admin consent to allow the application to use these permissions.