# Microsoft Sentinel

> Connect your Microsoft Sentinel workspace to Tidal Control with an Azure app registration, so compliance tests read your SIEM configuration. Read-only.

Source: https://tidalcontrol.com/docs/integrations/microsoft-sentinel

Tidal Control's Microsoft Sentinel integration reads the configuration of one Sentinel workspace for compliance purposes. It authenticates as an Azure app registration and reads the `Microsoft.SecurityInsights` resources on your Log Analytics workspace, which is the evidence auditors ask for on security monitoring and incident response.

## What this integration monitors

- **Open incidents:** Whether any high-severity incident is still unresolved
- **Analytics rules:** Whether the workspace has alert rules configured at all
- **Data connectors:** Whether the workspace is actually receiving security telemetry

## Requirements

- Super User role in Tidal Control
- An Azure subscription with a Microsoft Sentinel workspace
- Permission to create an app registration in Microsoft Entra ID, and to assign a role on the workspace

## Configuration step-by-step plan

We'll create an **app registration** with a client secret, give it read access to the Sentinel workspace, collect the workspace identifiers, then add the connection in Tidal Control.

**Configuration steps:**

1. **Create an app registration**
2. **Grant it read access to the workspace**
3. **Collect the workspace identifiers**
4. **Configure the integration in Tidal Control**

## Step 1: Create an app registration

- In the [Azure portal](https://portal.azure.com), open **Microsoft Entra ID → App registrations**
- Click **New registration**, name it, for example `Tidal Control`, and register it
- Copy the **Application (client) ID** and the **Directory (tenant) ID**
- Open **Certificates & secrets → New client secret**, then **copy the secret value immediately**: it is shown only once

## Step 2: Grant it read access to the workspace

- Open your Sentinel **Log Analytics workspace**, or the resource group containing it
- Go to **Access control (IAM) → Add role assignment**
- Assign **Microsoft Sentinel Reader** to the app registration from step 1

> **info:**

**Reader is enough.** Microsoft Sentinel Reader grants read access to incidents, analytics rules and data connectors, which is everything this integration needs. A Contributor or Owner role would let a compliance tool change your SIEM, so avoid it.

## Step 3: Collect the workspace identifiers

From the workspace's **Overview** page, note:

- The **Subscription ID** it belongs to
- The **Resource group** containing it
- The **workspace name**

## Step 4: Configure the integration in Tidal Control

- Go to **Settings → Integrations** in Tidal Control
- Click the **plus icon** next to **Microsoft Sentinel**
- Fill in the configuration:
  - **Name:** A descriptive name, for example `Microsoft Sentinel`
  - **Tenant ID:** The directory ID from step 1
  - **Client ID:** The application ID from step 1
  - **Client secret:** The secret value from step 1
  - **Subscription ID:** From step 3
  - **Resource group:** The resource group holding the workspace
  - **Workspace name:** The Log Analytics workspace name
- Click **"Create"** to save the integration

## Configuration fields explained

The integration dialog asks for the following values:

**Name:**
- A descriptive name for this connection
- For example: `Microsoft Sentinel`

**Tenant ID, Client ID and Client secret:**
- The app registration credentials from step 1
- All three are required. The client secret is stored as a secret

**Subscription ID, Resource group and Workspace name:**
- Which Sentinel workspace to read
- All three are required, and all identify one workspace

> **warning:**

**One connection covers one workspace.** All three location fields are required and point at a single Log Analytics workspace. If you run Sentinel in more than one workspace, add a separate connection for each.

## Verification

The integration is working when all of the following are true:

- Settings → Integrations shows Microsoft Sentinel under **Configured Integrations**
- Sentinel tests are available in the Tests section
- Test refresh returns results without authentication or authorisation errors

## Frequently asked questions

**Is this the same as the Microsoft Azure integration?**
No. The Azure integration covers the cloud platform's own configuration. This one reads Sentinel, the SIEM, and needs its own connection and its own role assignment.

**Does the client secret expire?**
Yes. Azure client secrets have an expiry date you choose at creation. When it lapses the integration stops authenticating, so note the date and rotate the secret in Tidal Control before it passes.

**Why does the analytics rules test matter if we have incidents?**
A workspace can hold historic incidents while having no active rules, which means nothing new is being detected. The two checks answer different questions.

## Common problems

**Authentication fails**
- Check the tenant, client and secret values, and that the secret has not expired

**Authorisation fails, or every test returns nothing**
- The role assignment is missing or scoped elsewhere. Assign Microsoft Sentinel Reader on the workspace or its resource group

**"Resource group is required" or "Workspace name is required"**
- All three location fields must be filled in. Copy them from the workspace Overview page

**Results are empty but the portal shows incidents**
- The connection points at a different workspace. Confirm the subscription, resource group and workspace name together

### Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

> **info:**

**Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.