elastic / elastic/integrations

[Spike] Entra ID: Evaluate Graph API as alternative to Azure Event Hubs

Open
#18,289 4 comments 2 reactions 0 assignees View on GitHub
Integration:azure Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

## Summary

Evaluate whether the Entra ID data stream within the `azure` integration can be migrated from Azure Event Hub to the Graph API, reducing infrastructure cost for customers.

## Background

A customer has requested an API-driven approach for collecting Entra ID logs (sign-in, audit, identity protection, provisioning) to avoid the cost and overhead of Azure Event Hub. The current architecture requires customers to provision a storage account container per each enabled integration which creates meaningful operational cost at scale.

Precedent: The `entityanalytics_entra_id` integration already uses the Graph API directly and does not rely on Event Hub.

## Questions
1. Does the Graph API expose the same Entra ID log categories currently collected via Event Hub (sign-in, identity protection, provisioning and audit)?
2. Are there other log types available exclusively via Graph API that would add value, such as [`riskDetections`, `riskyUsers`, `riskyServicePrincipals`, `CustomSecurityAttributeAuditLogs`](https://learn.microsoft.com/en-us/answers/questions/5820274/best-approach-to-ingest-entra-id-identity-protecti), and [Microsoft Entra Agent ID logs](https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents)?
4. Is the right implementation path to add Graph API as an alternative ingestion method within the existing Entra ID data stream or does this warrant a new standalone integration?
5. What Azure permissions and app registration requirements would a Graph API approach require compared to the current Event Hub setup?
6. What are the rate limits/pagination/delivery latency and other tradeoffs that make Graph API polling less viable for production log volumes?

## Requested action

This is a research/spike task, no build committment is required. Findings here should inform a follow-up enhancement issue or roadmap discussion, including whether this is feasible, a modification to the existing data stream or a new integration.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.