API & Integrations - Microsoft Entra ID Protection

Microsoft Entra ID Protection assists organizations in identifying, investigating, and addressing identity-based risks. These risks can be integrated with tools like Conditional Access to inform access decisions, or they can be sent to a security information and event management (SIEM) system for additional investigation and correlation.

Overview

The integration retrieves risk events generated by Microsoft's Entra ID Protection package through the Microsoft Graph API. These events are then forwarded to the Human Risk Platform, which associates each event with a specific user and updates that user's identity component within the attack factor.

• Please note that historical events will not be retrieved from Entra ID Protection; only events from the moment of integration onward will be processed. This approach simplifies onboarding, ensuring that we do not alter any historical attack factor scores that the admin may have already reviewed.
• This integration can be accessed from the Human Risk Command Center, which is available to all Mimecast Email Security Cloud Gateway customers. 

Prerequisites

1. You must have a Mimecast Engage license.
2. You must have a Microsoft Entra ID P2 license or better.

To configure the Microsoft Entra ID Protection integration with the Human Risk Platform, you must have one of the following roles:

• Global Sys Admin
• Sys Admin - SD Full
• Super Administrator
• Full Administrator
• Basic Administrator
• Partner Administrator
• Custom role with Integrations Marketplace having Read/Write enabled.

These roles are required to add, edit, or delete the integration configuration in the Integrations Hub.

Benefits

• The integration retrieves risk events generated by Microsoft’s Entra ID Protection package through the Mimecast API.
• It integrates with security platforms, such as Mimecast’s Human Risk Platform, providing security analysts with better visibility into identity-related attacks and enabling organizations to proactively respond to threats.
• Detects risks early, allowing customers to swiftly investigate any potential compromises.
• Exposes the threats and risks that your organization is currently facing.

Integration

To integrate Mimecast with Microsoft Entra ID Protection:

1. Log in to the Mimecast Administration Console.
2. Navigate to Integrations | Integrations Hub.

4. Find the Microsoft Entra ID Protection tile displayed in the integrations section.
5. Click on the Configure New button to start creating a new integration.

6. Fill out the integration creation form by providing an Application name and Description
7. Click on the Authorize button, which will redirect you to the Microsoft login page

8. Use your credentials for Microsoft Entra ID to log in and provide the necessary consent.

9. After logging in, validate the credentials and Accept the consent request.

10. Wait for the integration instance to be created and receive a success message.

11. Initially, the integration status may be Unavailable. Refresh the page to see the status change to Connected.
12. You can edit the integration to change the description or delete it using the available options.

Entra ID Protection Events

1. Navigate to the Human Risk Command Center to verify that events from Microsoft Entra ID are flowing into the system.
2. Events are categorized under Identity, and they do not contribute to the Human Risk Score at the individual or organization level.
   score.
3. Access the risk analysis page to see how events are categorized and scored.
4. Check individual user profiles to see how identity events impact their attack factor.
5. Click on specific events to view additional details such as email ID, username, and other relevant information.