[o365-plugin] Add Microsoft Entra ID Protection risk detection event collection

[mcjon3z]

Describe the feature

Enhance the Office 365 plugin to collect Microsoft Entra ID Protection risk detection events from the following Microsoft Graph API endpoint:

GET https://graph.microsoft.com/v1.0/identityProtection/riskDetections

Risk detections contain security-relevant information about suspicious user and sign-in activity identified by Microsoft Entra ID Protection. These events are not equivalent to the standard Microsoft 365 Unified Audit Log events currently obtained through the Office 365 Management Activity API.

The integration should collect risk detection records and ingest them into UTMStack as Microsoft 365 or Microsoft Entra security events.

Note that access to the endpoint requires the Microsoft Graph IdentityRiskEvent.Read.All application permission and an eligible Microsoft Entra ID P1 or P2 license.

Use Case

Microsoft Entra ID Protection identifies suspicious identity activity that may indicate account compromise. Examples include anonymized IP address usage, unfamiliar sign-in properties, malicious IP addresses, leaked credentials, atypical travel, password spray activity, suspicious browser behavior, and other identity-risk signals.

Collecting these events would allow UTMStack users to:

• Detect potentially compromised Microsoft Entra identities.
• Alert on high- and medium-risk identity activity.
• Correlate identity risks with Microsoft 365 audit events.
• Correlate a risk detection with its related sign-in using requestId or correlationId.
• Investigate suspicious IP addresses, locations, devices, and user agents.
• Track whether a detection remains at risk, has been confirmed, has been dismissed, or has been remediated.
• Create dashboards showing risk detections by user, risk level, risk type, state, location, and source.
• Retain risk detection events in UTMStack according to the organization's SIEM retention requirements.
• Include Microsoft Entra risk events in incident-response and compliance workflows.

The existing Office 365 Management Activity API integration does not provide the complete Microsoft Entra ID Protection risk detection resource available through this Microsoft Graph endpoint. Adding this source would improve identity-threat detection and investigation coverage.

Proposed Solution

Add a separate Microsoft Graph collection path to the Office 365 plugin for:

/v1.0/identityProtection/riskDetections

Other Information

Microsoft Graph resource:

https://graph.microsoft.com/v1.0/identityProtection/riskDetections

Microsoft documentation identifies the following requirements and behavior:

• Microsoft Entra ID P1 or P2 is required.
• The least-privileged delegated and application permission is IdentityRiskEvent.Read.All.
• The API supports $filter and $select.
• The default page size is 20 objects.
• $top can request up to 500 objects per page.
• Additional pages are exposed through Microsoft Graph pagination.
• The API is available in the Global, US Government L4, and US Government L5/DoD clouds.
• The API is not available in the Microsoft cloud operated by 21Vianet in China.

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change