Skip to main content

​
Required Permissions

The user authorizing the Microsoft Entra connection must be able to grant tenant-wide admin consent for Microsoft Graph permissions. This integration uses the /adminconsent endpoint with Microsoft Graph API permissions, which requires admin consent to authorize the application on behalf of the entire organization.
Important: This integration requires Microsoft Graph app roles (application permissions). Only Privileged Role Administrator or Global Administrator can grant admin consent for Microsoft Graph application permissions. Cloud Application Administrator and Application Administrator roles cannot grant consent for these permissions.

​
Microsoft Graph Permissions Required

The Leen Microsoft Entra app requires the following Microsoft Graph application permissions:
  • User.Read.All: Read user profiles
  • Group.Read.All: Read group information
  • Application.Read.All: Read application information
  • IdentityRiskyUser.Read.All: Read identity risk information
  • IdentityRiskEvent.Read.All: Read identity risk events
  • Policy.Read.All: Read organization policies
  • Policy.Read.Authentication: Read authentication policies
  • AuditLog.Read.All: Read audit logs and sign-in logs
Privileged Role Administrator (Recommended)
  • Can grant consent for apps requesting any permission, for any API
  • Can grant Microsoft Graph app roles (application permissions)
  • No limitations on API types or permission scopes
  • Full admin consent capabilities
Global Administrator
  • Can grant consent for any application
  • Can grant Microsoft Graph app roles (application permissions)
  • Has full access to all administrative features
  • Can grant admin consent without restrictions
Cloud Application Administrator ❌ (Not Sufficient)
  • Cannot grant consent for Microsoft Graph app roles (application permissions)
  • Cannot authorize this integration
Application Administrator ❌ (Not Sufficient)
  • Cannot grant consent for Microsoft Graph app roles (application permissions)
  • Cannot authorize this integration

​
Which Role to Use

Requirement: You must use a Privileged Role Administrator or Global Administrator account for the authorization in step 2. Since this integration requires Microsoft Graph app roles (application permissions), Cloud Application Administrator and Application Administrator roles do not have sufficient permissions.

​
Key Points

  • Admin consent is required to grant Microsoft Graph application permissions
  • The authorizing user must be a Privileged Role Administrator or Global Administrator
  • Cloud Application Administrator and Application Administrator cannot grant these permissions
  • Permissions must be explicitly granted even after application registration
  • Admin consent must be re-granted if application permissions are changed

​
Onboarding

Follow the steps below to onboard your environment to our Microsoft Defender app.
1

Create Microsoft Entra Connection

With your Leen API Key and your Customer’s Org ID, make a API request to create a new Microsoft Defender Connection. More information can be found on the API Reference page.
The response will look like this:
2

Granting permission to Leen app for Microsoft Entra

Open the oauth2_authorize_url from the previous step in a new tab. This will prompt the admin user to authorize Leen’s Microsoft Entra app to access their Microsoft Entra resources.Microsoft Entra-authOnce the user has authorized the app, they will be redirected to Leen on a successful authorization.Microsoft Entra-auth-success
3

Pull Data

Now that the user has authorized the app, you can pull data from Microsoft Defender using the connection_id from the first step. More information can be found on the API Reference page.