Microsoft
Microsoft integrations cover the identity, productivity and endpoint services most organizations depend on: Entra ID (formerly Azure AD) for authentication, Office 365 for mail and collaboration, Microsoft Defender for endpoint detections, Azure Event Hubs as the general-purpose pipe for Azure platform logs, and Windows Server itself. Together they answer who signed in, from where, what they did in mail and files, and what happened on the host — which is why this is usually the first category onboarded. Cloud services are collected through Microsoft's APIs or Event Hubs; Windows hosts forward their event logs through an agent as syslog.
In this section
- Azure Event Hubs — the general-purpose ingress for Azure platform, diagnostic and sign-in logs.
- Microsoft Defender — Defender XDR incidents and alerts from the Graph security API, plus the device, vulnerability and posture roster from the Defender for Endpoint API on SIEM → Resources.
- Office365 Audit API — the Office 365 unified audit log, authorised by an administrator approving Fluency's application.
- Office 365 Audit — that same unified audit log plus the Entra directory audit, sign-ins and directory resources, in one application authorised by a client secret you create.
- Office365 ResourceWatch — a periodic inventory of tenant users, groups, devices, applications and conditional access policies, on SIEM → Resources.
- AzureAD (Entra ID) Audit — the Entra directory audit read from Microsoft Graph.
- Windows Server — host-side collection: Active Directory and Sysmon guides, forwarded via NXLog.
Four templates, one overlapping data set
The Microsoft 365 templates are the most confusing part of this catalog, because four of them collect from overlapping sources. The split is by how the credential is obtained, not by what arrives:
| Office365 | Azure Directory Audit | Office365 Resource Watch | Office365-Audit | |
|---|---|---|---|---|
| Collects | Unified audit log | Entra directory audit | Tenant resource inventory | All three |
| Default authentication | Administrator consent | Administrator consent | Administrator consent | Client secret only |
| Who finishes the setup | An administrator, in their mailbox | An administrator, in their mailbox | An administrator, in their mailbox | You |
The first three are kept as separate pages rather than merged because each requests a different permission set, approved through a separate Entra application, and consenting to one does not consent to the others. All three can also be switched to a client secret by unticking Enable Admin Consent Mode on the install form, which reveals three hidden credential fields.
Two collection paths
Cloud tenants (Entra ID, Office 365, Defender) are collected by API or Event Hubs. Windows hosts are collected by an agent on the machine, which is a different setup entirely — see Windows Server.
Related
- Integrations catalog — all integration categories.
- Integration Matrix — which ingress method each product supports.
- Parser cookbooks — including a working Windows NXLog parser.
- Report cookbooks — AzureAD login and Office 365 user-activity reports.