How to enable API access to Microsoft Entra ID (AzureAD)?

This guide provides step-by-step instructions to enable audit log access in Microsoft Entra ID, formerly Azure Active Directory (AzureAD).

Prerequisites

1. Administrative access to Microsoft Entra ID.
2. An active subscription to Azure with Entra ID P1 or higher.
3. Necessary permissions to configure audit logging.
4. Patience.

Sign in to the Azure Portal

1. Go to Azure Portal - https://portal.azure.com
2. Sign in with your administrative account.

Register a new application

1. Azure Portal: Click on Microsoft Entra ID -> Manage on the left sidebar
   -or-
   Microsoft Entra admin center: Click Identity -> Applications on the left sidebar
2. Click App registrations
3. Then click + New registration.
4. Enter a name for your application, e.g. EventSentry or EventSentry Log Download
5. Set Supported account types based on your requirements ("Single Tenant" by default)
6. "Redirect URI" can be left empty
7. Click Register at the bottom.
8. After the application is registered, you will be redirected to the application's overview page.

Get the Application (client) ID and Directory (tenant) ID

1. Copy the Application (client) ID. This is your CLIENT_ID.
2. On the same overview page, you will find the Directory (tenant) ID. Copy this value as your TENANT_ID.

Create a client secret

1. Click on Certificates & secrets
2. Then under the Client secrets tab click + New client secret.
3. Provide a description for the client secret (e.g. "EventSentry" or "EventSentry Log Download") and set an expiration period. Setting a short expiration period is more secure but will require you to create new secrets when the credentials have expired.
4. Click Add.
5. IMPORTANT: After creating the client secret, copy the Value immediately. This is your CLIENT_SECRET. Note: You won’t be able to copy this secret later, so save it securely.

Assign API Permissions

1. On the left sidebar go to API permissions > Add a permission
2. Select Microsoft Graph.
3. Add delegated permissions: Choose Application permissions (Delegated won't work in most scenarios)
4. The required permissions for accessing logs are listed below. Recommended permissions are necessary for full log retrieval and all details.
5. After adding the necessary permissions, click Grant admin consent to allow the application to use these permissions.

IMPORTANT: You will need to obtain a new token in EventSentry if you made changes to the API permissions, since permissions are tied to the token