Microsoft Sentinel

Tidal Control's Microsoft Sentinel integration reads the configuration of one Sentinel workspace for compliance purposes. It authenticates as an Azure app registration and reads the Microsoft.SecurityInsights resources on your Log Analytics workspace, which is the evidence auditors ask for on security monitoring and incident response.

What this integration monitors

• Open incidents: Whether any high-severity incident is still unresolved
• Analytics rules: Whether the workspace has alert rules configured at all
• Data connectors: Whether the workspace is actually receiving security telemetry

Requirements

• Super User role in Tidal Control
• An Azure subscription with a Microsoft Sentinel workspace
• Permission to create an app registration in Microsoft Entra ID, and to assign a role on the workspace

Configuration step-by-step plan

We'll create an app registration with a client secret, give it read access to the Sentinel workspace, collect the workspace identifiers, then add the connection in Tidal Control.

Configuration steps:

1. Create an app registration
2. Grant it read access to the workspace
3. Collect the workspace identifiers
4. Configure the integration in Tidal Control

Step 1: Create an app registration

• In the Azure portal, open Microsoft Entra ID → App registrations
• Click New registration, name it, for example Tidal Control, and register it
• Copy the Application (client) ID and the Directory (tenant) ID
• Open Certificates & secrets → New client secret, then copy the secret value immediately: it is shown only once

Step 2: Grant it read access to the workspace

• Open your Sentinel Log Analytics workspace, or the resource group containing it
• Go to Access control (IAM) → Add role assignment
• Assign Microsoft Sentinel Reader to the app registration from step 1

Step 3: Collect the workspace identifiers

From the workspace's Overview page, note:

• The Subscription ID it belongs to
• The Resource group containing it
• The workspace name

Step 4: Configure the integration in Tidal Control

• Go to Settings → Integrations in Tidal Control
• Click the plus icon next to Microsoft Sentinel
• Fill in the configuration:
  • Name: A descriptive name, for example Microsoft Sentinel
  • Tenant ID: The directory ID from step 1
  • Client ID: The application ID from step 1
  • Client secret: The secret value from step 1
  • Subscription ID: From step 3
  • Resource group: The resource group holding the workspace
  • Workspace name: The Log Analytics workspace name
• Click "Create" to save the integration

Configuration fields explained

The integration dialog asks for the following values:

Name:

• A descriptive name for this connection
• For example: Microsoft Sentinel

Tenant ID, Client ID and Client secret:

• The app registration credentials from step 1
• All three are required. The client secret is stored as a secret

Subscription ID, Resource group and Workspace name:

• Which Sentinel workspace to read
• All three are required, and all identify one workspace

Verification

The integration is working when all of the following are true:

• Settings → Integrations shows Microsoft Sentinel under Configured Integrations
• Sentinel tests are available in the Tests section
• Test refresh returns results without authentication or authorisation errors

Frequently asked questions

Is this the same as the Microsoft Azure integration? No. The Azure integration covers the cloud platform's own configuration. This one reads Sentinel, the SIEM, and needs its own connection and its own role assignment.

Does the client secret expire? Yes. Azure client secrets have an expiry date you choose at creation. When it lapses the integration stops authenticating, so note the date and rotate the secret in Tidal Control before it passes.

Why does the analytics rules test matter if we have incidents? A workspace can hold historic incidents while having no active rules, which means nothing new is being detected. The two checks answer different questions.

Common problems

Authentication fails

• Check the tenant, client and secret values, and that the secret has not expired

Authorisation fails, or every test returns nothing

• The role assignment is missing or scoped elsewhere. Assign Microsoft Sentinel Reader on the workspace or its resource group

"Resource group is required" or "Workspace name is required"

• All three location fields must be filled in. Copy them from the workspace Overview page

Results are empty but the portal shows incidents

• The connection points at a different workspace. Confirm the subscription, resource group and workspace name together

Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.