Microsoft Entra ID Integration

Microsoft Entra ID, formerly known as Azure Active Directory, is an identity and access management solution that helps organizations secure and manage identities in cloud and on-premises environments.

When you configure the Microsoft Entra ID integration a target will become available in Cisco XDR automation for automated workflows.

Note: User data from Microsoft Entra ID has migrated to Identity Intelligence via Security Cloud Control. See Cisco Identity Intelligence for more information.

  1. In the Cisco XDR navigation menu, choose Administration > Integrations.

  2. On the Integrations page, click the Third-Party tab and navigate to the Microsoft Entra ID integration.

  3. Click the plus sign (+) in the lower-right corner of the card. The Microsoft Entra ID integration page is displayed.

  4. Expand the Integration Guide area and follow the instructions on how to add the Microsoft Entra ID integration in Cisco XDR.

You can perform the following tasks after you integrate Microsoft Entra ID with Cisco XDR:

  • Automation:

    • Workflows - The workflows for Microsoft Entra ID can be installed from the Automation Exchange. See Workflows and Exchange.

    • Target - The Microsoft Entra ID target is automatically created for out-of-box and custom workflows. See Targets Created From Integrations.

    • Playbooks - An Automation system workflow that uses Microsoft Entra ID and is included in the Cisco Managed Incident Playbook can be used to Contain Incident: Assets (Users). See Containment on the Response page.

  • Pivot Menu - Install the Microsoft Entra ID workflows from the Automation Exchange to use the Pivot menu to access actions in Microsoft Entra ID. Available actions include enabling and disabling users.