2. Connect Your First Source

The second step of the Quickstart: choose one real data source, connect it, and leave the platform actively collecting from it. This page is for the administrator doing the initial setup.

It uses Microsoft 365 as its worked example, connected with the Office365-Audit application template. That template exercises every part of the process in one pass (a credential you create in an external service, an application installed from a template, three data lake indexes, and a pipeline that appears on the platform's pipeline diagram), and it finishes in one sitting rather than waiting on someone else's approval.

The setup has two halves:

1. In Microsoft Entra ID: register an application, add nine read-only permissions across two Microsoft APIs, grant admin consent, and create a client secret. This produces three values: a Tenant ID, a Client ID, and a Client Secret. About 15 minutes.
2. In Fluency: install the Office365-Audit template and paste those three values into its form. About 5 minutes.

Before You Begin

• You can sign in to the portal (step 1) with an account that can install applications.
• You hold, or can borrow, an Entra identity that can both register an application and grant tenant-wide admin consent: Global Administrator, or Privileged Role Administrator combined with Application Administrator or Cloud Application Administrator.
• Unified audit logging is on in the Microsoft 365 tenant. Nothing reaches the Office 365 API until it is, and turning it on is not retroactive. Office 365 Audit → Before you begin has the PowerShell check.

Sign-in logs need a premium Entra licence

The Entra directory audit works on every tier. The sign-in log is premium-only: without Microsoft Entra ID P1 or P2, the AzureSigninLogs index stays empty and the rest of the integration is unaffected. That is expected, not a fault.

If you are not using Microsoft 365

The shape of this page is the same for every source: prepare the source side, install a template, look at the pipeline it built. Only the vendor-side half changes. Find your source in the Integration Matrix, then follow its own guide for the first half and rejoin this page at Step 3. If your source is a firewall, a server, or anything else on your own network, start at How Data Gets In instead; those arrive by syslog, HEC, or a collector rather than by API.

Step 1: Choose a Source

Criteria for a good first source

Prefer a source you fully control, that produces steady volume, and whose data you can recognize when you see it. Resist starting with your highest-volume production firewall: a first connection is for learning the mechanics, and a noisy source makes every subsequent step harder to read.

Why this page uses Microsoft 365

• It is entirely cloud-side. Nothing is installed on any machine you own.
• The credential is one you create yourself and can rotate on your own schedule, so the setup finishes in one sitting. The alternative Microsoft templates use administrator consent, which puts a decision in someone else's inbox and leaves the application reporting healthy and collecting nothing until they act on it.
• One application covers three feeds (the unified audit log, the Entra directory audit, and Entra sign-ins) instead of three applications with three separate consent grants.
• The data is well understood by the rest of the platform: the search page already ships facet configurations for it, and sign-in activity is exactly the kind of thing behavior rules score, so step 5 has something to show.

What arrives

Index	Source	Contents
Office365	Office 365 Management Activity API	The unified audit log: mail, file, site, Teams, admin, and DLP activity across every Microsoft 365 workload, plus service-health messages.
MSEntra	Microsoft Graph	Directory changes: users and groups created or modified, role assignments, application and consent grants, password resets.
AzureSigninLogs	Microsoft Graph	Interactive sign-ins with the client IP, device, application, conditional-access result, and risk state.

AzureAudit is the legacy name of the directory-audit index: older deployments write the directory audit to AzureAudit rather than MSEntra, and keep doing so.

Alongside those, the application reads the directory itself (users, groups, devices, applications, policies), which is what lets Fluency resolve an object GUID in an audit record to a name.

Step 2: Prepare the Source Side

Everything in this step happens in the Microsoft Entra admin center, or in the Azure portal under Microsoft Entra ID. Office 365 Audit is the full version of this half, including an Azure CLI and PowerShell script that does the same thing unattended; what follows is the shortest path through the portal.

2.1 Register the application

Go to App registrations → New registration.

• Name: anything recognisable. ingext-azureaudit is a good default.
• Supported account types: Accounts in this organizational directory only (single tenant).
• Redirect URI: leave blank. This application never signs a user in.

Click Register.

Register the app; do not create an enterprise application

App registrations → New registration is the right path. Enterprise applications → New application looks similar and produces a service principal, but gives you nowhere to add API permissions or a client secret. If you find yourself on a page headed Browse Microsoft Entra App Gallery, you are in the wrong place.

2.2 Add the Microsoft Graph permissions

On the new application, go to API permissions → Add a permission. On the Microsoft APIs tab choose Microsoft Graph, then Application permissions: the app-only path, for an application that runs without a signed-in user.

Search for and tick these six:

• AuditLog.Read.All
• Directory.Read.All
• Policy.Read.All
• Reports.Read.All
• UserAuthenticationMethod.Read.All
• MailboxSettings.Read

Take the .Read variant in each case, never .ReadWrite: the picker lists both next to each other, and the read-write permission is a strictly wider grant this integration has no use for. Click Add permissions.

2.3 Add the Office 365 Management API permissions

The unified audit log does not come from Graph. It comes from a separate API with its own service principal, so this is a second trip through Add a permission: Microsoft APIs → Office 365 Management APIs → Application permissions, then tick all three:

• ActivityFeed.Read
• ActivityFeed.ReadDlp
• ServiceHealth.Read

Click Add permissions. All nine should now be listed under Configured permissions as Microsoft Graph (6) and Office 365 Management APIs (3), every row with Type Application and Status Not granted.

If Office 365 Management APIs is not offered, the tenant has never had its service principal provisioned; Office 365 Audit has the one-line fix.

2.4 Grant admin consent

Application permissions do nothing until an administrator consents on the tenant's behalf. On the same API permissions page, click Grant admin consent for <tenant> and confirm.

All nine rows must then read a green Granted for <tenant>. If the button is greyed out, the account you are signed in as does not hold consent rights; the application and its permissions are already saved, so ask an administrator who does to open the same page and click it.

Consent applies to whatever is listed at the time you click. A permission added later but never consented to returns 403 while the others keep working, which reads as "the integration works, but SharePoint events are missing" rather than as an error.

2.5 Create a client secret

Go to Certificates & secrets → Client secrets → New client secret. Give it a description you will recognise in two years, choose an expiry, and click Add.

The drop-down opens on Recommended: 180 days (6 months) and the portal caps it at 24 months. Pick whatever your rotation policy allows, and write the expiry date down: when the secret expires, collection stops with no warning on the Fluency side.

Copy the Value now, and copy the Value, not the Secret ID

The new secret appears with its Value shown in full, exactly once. Navigate away and it is masked forever; the secret cannot be recovered, only replaced.

The Secret ID in the next column is not the secret. It stays fully readable, which is exactly why it gets copied by mistake, and pasting it into Fluency is the single most common cause of an application that installs and then immediately aborts.

2.6 Record the Tenant ID and Client ID

Go to the application's Overview page and copy two values from Essentials.

What to have in hand before leaving Microsoft

Three values, and only three. All of them go into the same form in step 3; nothing here is entered anywhere else.

Fluency field	Where it comes from	Sensitive?
Azure Tenant ID	Overview → Directory (tenant) ID	No: readable from the portal at any time
Azure ClientID	Overview → Application (client) ID	No: readable from the portal at any time
Azure ClientSecret	Certificates & secrets → the secret's Value	Yes: shown once, unrecoverable

Ignore Object ID. It identifies the application object in the directory and is not used here.

Step 3: Install the Application

v2 interface

1. In the navigation rail, open Applications and click Install Application. The Application Catalog opens, with a Search applications… field and an All categories drop-down above the template cards. Each card shows the template's icon, its name, and a one-line description, in rows of up to four under the category headings: AWS Services, Cloud Infrastructure (IaaS), Cloud-based Business Softwares, Email Audit and Protection, Endpoint Management, Office Software (SaaS) and IAM, On-Premise IT, and System Components, holding 72 templates between them.

   

2. Find the Office365-Audit card under the Office Software (SaaS) and IAM category: pick the category from the drop-down, or type Office365 in the search field. Its description reads Combined Office365 Audit Event, AzureAD Audit and Azure AD Resource Integrations.

3. Click the card. The Install Office365-Audit form opens, with a Back to Catalog link above its title.

4. Leave Instance name and Display name, in the Application section, at default / Default for a first install. Change both when you add a second instance of the same template (collecting from two Microsoft 365 tenants, for example) so you can tell them apart on the applications list.

5. Fill in the Configuration section. Every field is required:

   Field	What to enter
   Azure Tenant ID	The Directory (tenant) ID from step 2.6.
   Azure ClientID	The Application (client) ID from step 2.6.
   Azure ClientSecret	The secret Value from step 2.5, not the Secret ID. Masked once the application is installed.
   datalake index name for Entra ID (AzureAudit) events	Pre-filled MSEntra. Receives the directory audit.

6. Leave Advanced configuration collapsed. The collapsed section below Configuration holds two more fields: datalake, pre-filled managed for the platform-managed lake, and datalake index name, pre-filled Office365 for the unified audit log. Both defaults are right for a first install, which is why they are tucked away; click the heading to open the section only to send this application somewhere other than the managed lake, or to dodge the index-name collision described below.

7. Click Dry run. The platform checks the configuration and the three credentials against Microsoft without installing anything (the button reads Checking… for up to 45 seconds) and then shows Dry run passed or Dry run failed above the buttons, with a table of the checks it made. A wrong tenant, client ID, or secret shows up here rather than as an application in error later.

8. Click Install Application. There is no separate save-then-start step. The Applications page opens with the notice Default is launching., and the new application is listed with its status badge.

Every template's form has the same shape; only the Configuration section changes, and it is absent entirely on templates that take no settings.

• Application: Instance name and Display name, both required, pre-filled with default and Default.
• Configuration: the template's own fields.
• Advanced configuration: a collapsed section holding datalake and datalake index name, on the templates that let you choose where the events land.

Required fields carry an asterisk after the label. Cancel, Dry run, and Install Application sit at the bottom right; Cancel returns to the catalog without installing. After a failed dry run, Install Application becomes Install anyway, greyed out until you tick the box confirming you want to install despite the failed checks. Every other template's form, field by field, is in the Application Catalog.

Classic v1 interface

1. Open Platform → Applications and select Install Application From Template.

2. Find the Office365-Audit tile under the Office Software (SaaS) and IAM category. The catalog is a stack of category cards with a Search box spanning the top; every tile shows the template's icon and display name, and the tiles wrap across the card, usually four to a row. The eight categories, AWS Services, Cloud-based Business Softwares, Cloud Infrastructure (IaaS), Email Audit and Protection, Endpoint Management, Office Software (SaaS) and IAM, On-Premise IT, and System Components, hold 72 templates between them.

   

3. Click the tile. A Setup New Office365-Audit Application panel opens on the right.

4. Leave Name and Display Name at default / Default for a first install. Change both when you add a second instance of the same template (collecting from two Microsoft 365 tenants, for example) so you can tell them apart on the applications list.

5. Fill in the Parameters. Every one of them is required:

   Parameter	What to enter
   Azure Tenant ID	The Directory (tenant) ID from step 2.6.
   Azure ClientID	The Application (client) ID from step 2.6.
   Azure ClientSecret	The secret Value from step 2.5, not the Secret ID. Masked once the application is installed.
   datalake index name for Entra ID (AzureAudit) events	Pre-filled MSEntra. Receives the directory audit.

6. Leave Advanced Configurations collapsed. The collapsed row below Parameters holds two more fields: datalake, pre-filled managed for the platform-managed lake, and datalake index name, pre-filled Office365 for the unified audit log. Both defaults are right for a first install, which is why they are tucked away; expand the row only to send this application somewhere other than the managed lake, or to dodge the index-name collision described below.

7. Press Install. There is no separate save-then-start step.

Every template's panel has the same sections; only the Parameters list changes, and it is absent entirely on templates that take none.

• Application: Template Name and Description, both read-only. They identify the template you clicked.
• Details: Name and Display Name, both required, pre-filled with default and Default.
• Parameters: the template's own fields.
• Advanced Configurations: a collapsed row holding datalake and datalake index name, on the templates that let you choose where the events land.

Required fields carry a red asterisk after the label. Install sits in the lower-right corner; the X in the title bar closes the panel without installing. The panel is a fixed height and its body scrolls, so on longer forms the last parameters sit below the fold when it first opens. Every other template's form, field by field, is in Install Application From Template.

Two index names means two chances to collide

Two applications writing to the same index name in the same lake collide, and the second one aborts. Office365 is also the default for the separate Office365 template, and MSEntra is also the default for Azure Directory Audit and Azure Directory Audit (Event Hub), so this template cannot run alongside any of those at their defaults. Either change the names here, or uninstall the separate application first; to uninstall, click Uninstall at the top right of the application's details page (v1: the red Uninstall button at the foot of its details panel on Platform → Applications). Azure Directory Audit also collects the same Entra feed into the same table indexes, so run one or the other in any case. Note that the two names live in different places on the form: the directory-audit index name is in Configuration (v1: Parameters), while the Office365 one is the datalake index name inside Advanced configuration (v1: Advanced Configurations).

The sign-in stream lands in a third index, AzureSigninLogs, which the install creates and which is not exposed as a parameter, so it cannot be renamed to dodge a collision.

About Integrations

Some templates take their credentials from a stored integration rather than from the install form, which is worth doing when several applications share one credential. The AWS templates have their own version of this. A role registered on Configuration → AWS Roles (v1: Settings → Advanced → AWS Roles) appears in their Pre-defined AWS Role drop-down, so one role serves every application that reads from that AWS account. See Connecting to AWS.

The Microsoft templates are not one of those. Office365-Audit takes its tenant ID, client ID, and secret directly on the form, and you do not need to visit the Integrations page at all for this quickstart.

v2 interface

You will still see your new connection listed on the Integrations page, one of the cards on Configuration, once it is running. The page is subtitled A list of active integrations and integration types, with a + Create Integration button on the right, and shows the account's integrations as cards grouped under category headings. Each card shows the service icon, the integration's name (a long one cut short with an ellipsis) and its type, and some add a Status line such as Status: running. Integrations waiting on a consent invitation are grouped under Invitations.

The example above holds an AzureAuditEventHub-default card, of type Azure EventHubs, under Cloud Infrastructure (IaaS). An Office365-Audit install named default adds one card per integration it creates: Office365Audit-default (type Office365), Office365Audit-default-ResourceWatch (ResourceWatch) and Office365Audit-default-AzureAudit (Azure AD Audit).

Classic v1 interface

You will still see your new connection listed there once it is running. The Integrations page, opened from the View Integrations button on Platform → Applications, is subtitled A list of active integrations and integration types. A yellow banner below the title reads Applications is where sources are installed and managed. Use this page only when you need to work with an integration directly. Below it the page has two regions: a view selector on the left with Existing Integrations, New Integration and Invitations, and the integration list on the right, grouped into category panels (only the categories that hold something are shown). Each tile shows the service icon, the integration's instance name, and its type, outlined in green while it is active. The example above holds a single AzureAuditEventHub-default tile, of type Azure EventHubs, in a Cloud Infrastructure (IaaS) panel. An Office365-Audit install named default adds three tiles under Office Software (SaaS) and IAM, one per integration it creates: Office365Audit-default (type Office365), Office365Audit-default-ResourceWatch (ResourceWatch) and Office365Audit-default-AzureAudit (Azure AD Audit). Invitations holds one tile per pending consent invitation, with its name, type and status. Existing Integrations covers the tiles and the dialog behind each one.

What the application creates for you

Installing an application stands up the source, the processors, and the sinks as a unit. That is why the next step's pipeline diagram suddenly has more in it than it did five minutes ago: an Office365-Audit install produces three plugin data sources, one per collection path, feeding two routers, which fan out to the data lake sinks and to two management queues, and it creates the three indexes in the managed lake as a side effect. That last detail is why a name that is already taken aborts the whole application rather than just one stream.

Step 4: Look at the Pipeline It Built

v2 interface

1. In the navigation rail, open Platform.
2. Find the new sources, routers, and sinks.
3. Trace the path a record will take, left to right.

Classic v1 interface

1. Open Platform → Configuration.
2. Find the new sources, routers, and sinks.
3. Trace the path a record will take, left to right.

The purpose of this step is comprehension, not configuration; do not change anything yet.

v2 interface

The page is titled Platform, subtitled The configuration and status of the platform., with a Refresh button on the right that reloads the diagram. It draws the pipeline as three columns read in the direction data flows: Sources, Routers, and Sinks. Each column ends with a dashed button (Add Source +, Add Router +, Add Sink +) for creating a new node of that type.

• A source card shows a type icon, the source name, and a label for the transport feeding it. An API-polled feed like this one appears as Plugin Data Source; other transports appear as Mgmt Queue or Cloud Syslog.
• A router card lists the pipes it runs, each row showing the pipe name and its processor count, for example (1 procs).
• A sink card shows the sink name and its type label, such as Data Lake or Mgmt Queue.

Nodes that are actively moving data are outlined in green, with a small green graph of their recent volume above the card's upper-right corner; idle nodes have a grey outline and no graph. Small circular ports sit on the edges of each card, and the lines between them trace the path an event takes: solid green where a connection is carrying data, solid grey from an idle node. Every card opens a panel with that component's settings, state, and event metrics; see Platform.

Classic v1 interface

The page is titled Configurations, subtitled The configuration and status of the platform., and draws the pipeline as three columns read in the direction data flows: Sources, Routers, and Sinks. Each column ends with a dashed button (Add Source +, Add Router +, Add Sink +) for creating a new node of that type.

• A source card shows a type icon, the source name, and a label for the transport feeding it. An API-polled feed like this one appears as Plugin Data Source; other transports appear as Cloud Syslog, AWS S3 w/ SQS, or Mgmt Queue.
• A router card lists the pipes it runs, each row showing the pipe name and its processor count, for example (1 procs).
• A sink card shows the sink name and its type label.

Nodes that are actively moving data are outlined in green and display a small green throughput graph above the card's upper-right corner; idle nodes have a gray outline and no graph. Small circular ports sit on the edges of each card, and the coloured lines between them trace the exact path an event takes; line colours distinguish the individual flows where several cross.

Immediately after an install the new nodes will be grey. Green means data has moved, and that is step 3.

How to Tell It Worked

v2 interface

• The application is listed on Applications as Office365-Audit, with its display name beneath it and a green Running badge.
• Its details page, opened by clicking its row, shows the values you entered under Parameters with the secret masked, and an Actions list of the setup steps the install carried out.
• New sources, routers, and sinks are visible on the Platform diagram.
• In Entra, all nine permissions read Granted for <tenant> and the client secret has not expired.

Classic v1 interface

• The application appears in Installed Applications as Office365-Audit: Office365-Audit, with a green Running badge.
• Its details panel, behind the blue eye button, shows the parameters you entered with the secret masked, and an Actions list of the pipeline objects the install created.
• New sources, routers, and sinks are visible on the Configuration diagram.
• In Entra, all nine permissions read Granted for <tenant> and the client secret has not expired.

Seeing events in search is not the check for this step

That is step 3, and it can lag by hours: up to 12 for the Office 365 unified audit log on a brand-new subscription. An application that reports Running with an empty index on the afternoon of the install has not failed.

If It Did Not Work

Symptom	Likely cause	What to do
Error (v1: Aborted) immediately after install, with an index name in the error message	That index name is already taken in the lake	Uninstall the conflicting application, or reinstall this one with different index names.
Error (v1: Aborted), and no index is named in the error	The Secret ID was pasted instead of the secret Value, or the secret has expired	Uninstall, then reinstall with the secret's Value. If it was never captured, create a new secret; the old value is unrecoverable.
Running, but the Office365 index stays empty	Unified audit logging is off in the tenant, or the subscription is still inside its first-content window	Check UnifiedAuditLogIngestionEnabled. If it is True, wait out the 12 hours before investigating further.
MSEntra fills but AzureSigninLogs stays empty	The tenant has no Entra ID P1 or P2 licence	Expected. The sign-in API is premium-only; the rest of the integration is unaffected.
Some calls return 403 Forbidden while others work	Admin consent was granted before all nine permissions were added	Return to API permissions and Grant admin consent again. Every row must read Granted.
Collection worked, then stopped months later	The client secret expired; 180 days is the portal's default	Rotate the secret.

To uninstall, click Uninstall at the top right of the application's details page (v1: the red Uninstall button at the foot of its details panel on Platform → Applications). In the v2 interface, running Dry run before Install Application catches a wrong or expired secret before anything is installed.

The full symptom table, including the AF10001 and AF20022 API error codes, is on Office 365 Audit → Troubleshooting.

Next Step

3. Confirm Data Is Arriving: verify ingress in three independent places.

Related

• Office 365 Audit: the full worked integration, including the scripted alternative and how to rotate the secret
• Microsoft integrations: the other Microsoft 365 templates, and which one to choose
• Integration Matrix: which sources are supported, and by which method
• How Data Gets In: syslog, HEC, API polling, agents, and collectors
• Fluency Platform: the pipeline model the application builds for you
• Application Catalog and Platform: the two pages this step visits, control by control (v1: Install Application From Template and Platform → Configuration)