Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Data Connectors Reference

15 October 2026Doc update+11 / −5 lines

In brief

The connector reference now uses a relative setup-guide link, an anonymized server URL example, and reformatted CrowdStrike region mapping table.

What Defender admins need to know

No administrator action is required; use the updated link and examples when consulting connector setup guidance.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

This connector receives data from external security systems that push logs to Microsoft Sentinel. The external system must be configured to send raw event data to the Microsoft Sentinel Ingestion API. Clicking on Deploy will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token.

Learn more about the connector setup processLearn more about the connector setup process

Azure Resource Deployment

Set up API access in your Airlock Digital SaaS tenant before connecting.

Your server URL comes from your portal address: take https://portal.au.YourDomain.example.com/tenant/XYZ/dashboard and drop the portal. prefix and everything after the top-level domain, leaving https://au.YourDomain.example.com.

The user API key, directory ID and tenant ID are in Airlock Digital under User Menu > My Profile.

Prerequisites:

  • Azure DevOps Prerequisite: Please ensure the following: 1. Register an Entra App in Microsoft Entra Admin Center under App Registrations. 2. In 'API permissions' - add Permissions to 'Azure DevOps - vso.auditlog'. 3. In 'Certificates & secrets' - generate 'Client secret'. 4. In 'Authentication' - add the Redirect URI found below in the corresponding field. 5. In the Azure DevOps settings - enable audit log and set View audit log for the user. Azure DevOps AuditingAzure DevOps Auditing. 6. Ensure the user assigned to connect the data connector has the View audit logs permission explicitly set to Allow at all times. This permission is essential for successful log ingestion. If the permission is revoked or not granted, data ingestion will fail or be interrupted.

Setup Instructions:

  1. Choose the ‘Specify template’ option, then ‘Upload a template file’ by clicking on ‘Choose file’ and selecting the appropriate CloudFormation template file provided below. click ‘Choose file’ and select the downloaded template.
  2. Click 'Next' and 'Create stack'.

Make sure that your bucket will be created in the same AWS region as your Falcon CID where the FDR feed is provisioned. |

CrowdStrike region | AWS region | |-----------------|-----------| |
US-1 | us-west-1 | |
US-2 | us-west-2 | |
EU-1 | eu-central-1

  • Template 1: OpenID connect authentication deployment: <variable value provided at install time>
  • Template 2: AWS CrowdStrike resources deployment: <variable value provided at install time> Using your own S3 Bucket In order to use your own S3 bucket you can refernace the following guide Use your own S3 bucket or follow this steps:

This connector receives data from external security systems that push logs to Microsoft Sentinel. The external system must be configured to send raw event data to the Microsoft Sentinel Ingestion API. Clicking on Deploy will trigger the creation of Log Analytics tables and a Data Collection Rule (DCR). It will then create an Entra application, link the DCR to it, and set the entered secret in the application. This setup enables data to be sent securely to the DCR using an Entra token.

Learn more about the connector setup processLearn more about the connector setup process

Azure Resource Deployment