elastic / elastic/integrations
[Spike] Entra ID: Evaluate Graph API as alternative to Azure Event Hubs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
## Summary
Evaluate whether the Entra ID data stream within the `azure` integration can be migrated from Azure Event Hub to the Graph API, reducing infrastructure cost for customers.
## Background
A customer has requested an API-driven approach for collecting Entra ID logs (sign-in, audit, identity protection, provisioning) to avoid the cost and overhead of Azure Event Hub. The current architecture requires customers to provision a storage account container per each enabled integration which creates meaningful operational cost at scale.
Precedent: The `entityanalytics_entra_id` integration already uses the Graph API directly and does not rely on Event Hub.
## Questions
1. Does the Graph API expose the same Entra ID log categories currently collected via Event Hub (sign-in, identity protection, provisioning and audit)?
2. Are there other log types available exclusively via Graph API that would add value, such as [`riskDetections`, `riskyUsers`, `riskyServicePrincipals`, `CustomSecurityAttributeAuditLogs`](https://learn.microsoft.com/en-us/answers/questions/5820274/best-approach-to-ingest-entra-id-identity-protecti), and [Microsoft Entra Agent ID logs](https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents)?
4. Is the right implementation path to add Graph API as an alternative ingestion method within the existing Entra ID data stream or does this warrant a new standalone integration?
5. What Azure permissions and app registration requirements would a Graph API approach require compared to the current Event Hub setup?
6. What are the rate limits/pagination/delivery latency and other tradeoffs that make Graph API polling less viable for production log volumes?
## Requested action
This is a research/spike task, no build committment is required. Findings here should inform a follow-up enhancement issue or roadmap discussion, including whether this is feasible, a modification to the existing data stream or a new integration.
Contributor guide
Assessment
This issue has not been assessed yet.