+8Hi everyone,
I have some issues, since 17th July the connector of Ingest Office 365 Security and Compliance alerts using Graph API
The alert that is not ingesting is this one:
I didnt touch anything from the config, this is the config that I didnt touch
U guys know if something change?
Thanks!
Best answer by thineth_dasun
Hi,
This is a known behavior that usually happens with Microsoft Graph Security API connectors in SecOps due to API versioning changes or credential/permission expirations on the Azure AD / Entra ID side.
Here are the step-by-step troubleshooting checks to identify and fix why the alerts stopped ingesting:
Even if you didn't change the configuration in SecOps SOAR:
Client Secret Expiration: Check if the Client Secret associated with your Azure AD App Registration expired around July 17th.
Graph API Permissions: Verify that the App Registration still has active, consented permissions for Microsoft Graph API:
SecurityAlert.Read.All or SecurityAlert.ReadWrite.All
OAuth Token Grant: Ensure no admin consent was revoked for the tenant.
Looking at your configuration screenshot, Use V2 API is checked.
Microsoft has been deprecating legacy Graph Security API v1.0 endpoints and shifting alert schema objects to Microsoft Defender XDR API / Graph Security API v2.0 (/security/alerts_v2).
Try unchecking Use V2 API temporarily (or toggle it) to test if the connector fetches the payload using the alternative schema endpoint.
In SecOps SOAR, go to Settings > Integrations > Connectors.
Locate the Office 365 Security and Compliance connector instance.
Click on Connector Logs / Execution Log.
Look for specific HTTP error codes around the polling cycles after July 17th:
401 Unauthorized / 403 Forbidden: Indicates an expired secret or missing API permission scope.
429 Too Many Requests: Microsoft Graph API rate limiting (Throttling).
400 Bad Request: Filter/Status schema mismatch on the Graph endpoint.
In your config, Alert Statuses to fetch is set to Active, Investigating, unknown, newAlert, inProgress.
Note that in the first screenshot, the alert status is Closed. If Microsoft Defender automatically closed or resolved the alert upon creation, this connector filter will intentionally skip/filter it out.
Hope this helps narrow down the issue! Let us know what you see in the connector execution logs.
+6Hi,
This is a known behavior that usually happens with Microsoft Graph Security API connectors in SecOps due to API versioning changes or credential/permission expirations on the Azure AD / Entra ID side.
Here are the step-by-step troubleshooting checks to identify and fix why the alerts stopped ingesting:
Even if you didn't change the configuration in SecOps SOAR:
Client Secret Expiration: Check if the Client Secret associated with your Azure AD App Registration expired around July 17th.
Graph API Permissions: Verify that the App Registration still has active, consented permissions for Microsoft Graph API:
SecurityAlert.Read.All or SecurityAlert.ReadWrite.All
OAuth Token Grant: Ensure no admin consent was revoked for the tenant.
Looking at your configuration screenshot, Use V2 API is checked.
Microsoft has been deprecating legacy Graph Security API v1.0 endpoints and shifting alert schema objects to Microsoft Defender XDR API / Graph Security API v2.0 (/security/alerts_v2).
Try unchecking Use V2 API temporarily (or toggle it) to test if the connector fetches the payload using the alternative schema endpoint.
In SecOps SOAR, go to Settings > Integrations > Connectors.
Locate the Office 365 Security and Compliance connector instance.
Click on Connector Logs / Execution Log.
Look for specific HTTP error codes around the polling cycles after July 17th:
401 Unauthorized / 403 Forbidden: Indicates an expired secret or missing API permission scope.
429 Too Many Requests: Microsoft Graph API rate limiting (Throttling).
400 Bad Request: Filter/Status schema mismatch on the Graph endpoint.
In your config, Alert Statuses to fetch is set to Active, Investigating, unknown, newAlert, inProgress.
Note that in the first screenshot, the alert status is Closed. If Microsoft Defender automatically closed or resolved the alert upon creation, this connector filter will intentionally skip/filter it out.
Hope this helps narrow down the issue! Let us know what you see in the connector execution logs.
+8Hey there,
Thanks for the reply, i configured all over again, and it seems its working.
Thanks!!
+6Hi
No need for thanks, brother.
We are all part of the Google Cloud Security Community family.
After all, there is no point in brotherhood if one brother doesn't help another.
In any case, I am glad the issue was resolved.
God bless you.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
