---
title: Microsoft Graph
description: >-
  Integrate with Microsoft Graph to collect security logs from Defender,
  Purview, Entra ID, and Sentinel
breadcrumbs: Docs > Integrations > Microsoft Graph
---

# Microsoft Graph
Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

Use the [Microsoft Graph](https://learn.microsoft.com/graph/security-concept-overview) security API to connect Microsoft security products, services, and partners to streamline security operations and improve threat protection, detection, and response capabilities.

The Microsoft Graph security API is an intermediary service (or broker) that provides a single programmatic interface to connect multiple Microsoft Graph security providers (also called security providers or providers). Requests to the Microsoft Graph security API are federated to all applicable security providers. The results are aggregated and returned to the requesting application in a common schema.

This integration gathers security events from the following products:

- Microsoft Entra ID Protection
- Microsoft 365 Defender
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Endpoint
- Microsoft Defender for Identity
- Microsoft Defender for Office 365
- Microsoft Purview Data Loss Prevention
- Microsoft Sentinel

## Setup{% #setup %}

To collect Microsoft Graph Events, click **Authorize** to authenticate using OAuth.

To integrate Microsoft Graph with Datadog, the authenticated user must have the following permission scopes:

- `offline_access`
- `APIConnectors.Read.All`
- `SecurityAlert.Read.All`

## Data Collected{% #data-collected %}

### Logs{% #logs %}

Microsoft Graph collects all available Microsoft Graph Security Events.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).