Microsoft Entra ID Protection (Azure AD Identity Protection)
LAST UPDATED: JUNE 24, 2025
Overview
Microsoft Entra ID Protection is a security tool that detects, investigates and remediates identity-based risks in organizational environments. The collection of Microsoft Graph APIs enables users to query risks detected by identity protection.
D3 SOAR is providing REST operations to function with Microsoft Entra ID Protection.
Microsoft Entra ID Protection is available for use in:
Connection
To connect to Microsoft Entra ID Protection from D3 SOAR, please follow this part to collect the required information below:
Parameter | Description | Example |
Server URL | The Microsoft Entra ID Protection server URL for the connection. | https://graph.microsoft.com |
Auth URL | The auth URL to authenticate the connection. The input URL is https://login.microsoftonline.com/{<tenant_id>}/oauth2/v2.0/token. Replace <tenant_id> with your tenant ID. | https://login.microsoftonline.com/{{tenant_id}}/oauth2/v2.0/token |
Api Version | The version of the API to use for the connection. The default value is v1.0. | v1.0 |
Grant Type | The grant type to authenticate the API connection. Only the client_credentials grant type is supported. | client_credentials |
Client ID | The client ID to authenticate the API connection. | 9c8**************f8a |
Client Secret | The client secret to authenticate the API connection. | 8lE***************vbh |
Scope | The scope for the API connection. This is a fixed default value. No input action is required. | https://graph.microsoft.com/.default |
Permission Requirements
Each endpoint in the Microsoft Entra ID Protection API requires a certain permission scope. The following are required scopes for the commands in this integration:
Command | Required Permission |
Confirm Compromised | IdentityRiskyUser.ReadWrite.All |
Dismiss Risky User | IdentityRiskyUser.ReadWrite.All |
Fetch Event | Permission requirements as organized by event type:
|
List History | IdentityRiskyUser.Read.All |
List Risk Detections | IdentityRiskEvent.Read.All |
List Risky Users | IdentityRiskyUser.Read.All |
List Sign-In | AuditLog.Read.All and Directory.Read.All |
Test Connection | No permission needed |
READER NOTE
The permission list above is used for Application Permissions since the Grant Type is client_credential only. No Delegated permission is needed in this case.
Configuring Microsoft Entra ID Protection to Work with D3 SOAR
Log in to the Azure Portal (https://portal.azure.com/).
Navigate to the top search bar, then search and select App registrations.
If you already have created apps, you can use one of them. Skip to step 5 to obtain the Client ID & Tenant ID. If you do not have an app, click + New registration to create one.
Register the application.
Enter an application Name.
For Supported account types, select Accounts in this organizational directory only (<Your Directory Name> only - Single tenant).
Click Register.
In the App Overview tab, copy and save the Application(client) ID and Directory(tenant) ID. They will be required to build the integration connection in D3 SOAR. Navigate to Client credentials, then click Add a certificate or secret.
Click + New Client Secret. Enter a Description for the client secret, and select a client secret expiry period using the Expires dropdown menu. Click Add. Note: The client ID will not be able to access the API resources after the client secret expires. You must renew the client secret to keep the client ID active.
Copy and save the Secret Value. It will be required to build the integration connection in D3 SOAR connection. Note: The created Client Secret can only be viewed once. Store it in a secure location before leaving the page.
Configure the API permissions. Click API permissions on the left navigation menu, then + Add a permission. Select Microsoft Graph, then search and select the required Application permissions. After selecting the required permissions, click Add permissions. See Permission Requirements for the required permissions for each command in this integration.
Some permissions may need to be granted admin consent for your directory (d3uat in the sample screenshot) to use. Ensure Grant admin consent for <Your Directory> is checked.
You may see Not granted for <Your Directory> in the status column. Those are the ungranted permissions you want to use. After successfully granting permissions, a green checkmark will appear under the permission status column for the corresponding permissions. If your login account does not have admin privileges, ask your admin to grant consent.
Configuring D3 SOAR to Work with Microsoft Entra ID Protection
Log in to D3 SOAR.
Find the Microsoft Entra ID Protection integration.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
Navigate to Configuration on the top header menu.
Click on the Integration icon on the left sidebar.
Type Microsoft Entra ID Protection in the search box to find the integration, then click it to select it.
Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to Microsoft Entra ID Protection.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
Connection Name: The desired name for the connection.
Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.
Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
Description (Optional): Add a description for the connection.
Tenant (Optional): When configuring the connection from a master tenant site, users have the option to choose the specific tenant sites to share the connection with. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.
Configure User Permissions: Defines which users have access to the connection.
Active: Check the checkbox to ensure the connection is available for use.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
1. Input the Auth URL. The input URL is https://login.microsoftonline.com/{<tenant_id>}/oauth2/v2.0/token. Replace <tenant_id> with your tenant ID. See step 5 of Configuring Microsoft Entra ID Protection to Work with D3 SOAR for instructions on obtaining the tenant ID.
2. Input the API version. The default value is v1.0.
3. Input the saved Client ID. See step 5 of Configuring Microsoft Entra ID Protection to Work with D3 SOAR.
4. Input the saved Client Secret. See step 5 of Configuring Microsoft Entra ID Protection to Work with D3 SOAR for instructions on obtaining the tenant ID.
Note: The Grant Type and Scope parameters do not require an input. The default values are fixed in order for the connection to pass.Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.
Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.
Test the connection.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.
Click OK to close the alert window.
Click + Add to create and add the configured connection.
Commands
Microsoft Entra ID Protection includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.
Integration API Note
For more information about the Microsoft Entra ID Protection API, refer to the Microsoft Entra ID Protection API reference.
READER NOTE
Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Microsoft Entra ID Protection to Work with D3 SOAR for details.
Confirm Compromised
Confirms one or more riskyUser objects as compromised. This action sets the targeted user's risk level to high.
READER NOTE
User IDs is a required parameter to run this command.
Run the List Risky Users command to obtain the User IDs. User IDs can be found under path $.value[*].id in the returned raw data.
Input
Input Parameter | Required/Optional | Description | Example |
User IDs | Required | The IDs of the Users to confirm as compromised. User IDs can be obtained using the List Risky Users command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Confirm Compromised failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: User IDs Not Found. |
Error Sample Data Confirm Compromised failed. Status Code: 404. Message: User IDs Not Found. |
Dismiss Risky User
Dismisses the risk of one or more riskyUser objects. This action sets the targeted user's risk level to none.
READER NOTE
User IDs is a required parameter to run this command.
Run the List Risky Users command to obtain the User IDs. User IDs can be found under path $.value[*].id in the returned raw data.
Input
Input Parameter | Required/Optional | Description | Example |
User IDs | Required | The IDs of the users for which to dismiss risk. User IDs can be obtained using the List Risky Users command. |
JSON
|
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Dismiss Risky User failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 404. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: User IDs Not Found. |
Error Sample Data Dismiss Risky User failed. Status Code: 404. Message: User IDs Not Found. |
Fetch Event
Retrieves Microsoft Entra ID sign-in logs, risk detections, or at risk user events and ingests them into D3 vSOC. For sign-in logs, it includes interactive user sign-ins (e.g., username/password authentication) and successful federated sign-ins. The logs are sorted by most recent sign-ins and limited events within the Azure AD default retention period. See How long does Microsoft Entra ID store the data? for details.
Input
Input Parameter | Required/Optional | Description | Example |
Start Time | Optional | The start time (in UTC) to filter the returned events. By default, the Start Time is 24 hours before the End Time. | 04/15/2024 01:00 AM |
End Time | Optional | The end time (in UTC) to filter the returned events. By default, the End Time is the Current time. | 04/16/2024 01:00 AM |
Number of Event(s) Fetched | Optional | The maximum number of the most recent events to return. Valid values are integers between 1 and 100. By default, all events matching query parameters will be returned. | 10 |
Event Type | Optional | The type of event to retrieve. Available options are:
By default, the value is Sign-in Logs. | Risk Detections |
User Principal Names | Optional | The principal names of users for which to retrieve events. By default, all events regardless of their user principal name are returned. |
JSON
|
Risk Detail | Optional | The specific risk reason by which to filter events. By default, all events regardless of their risk detail are returned. | Admin Generated Temporary Password |
Risk State | Optional | The specific risk state by which to filter events. Available options are:
By default, all events regardless of their risk state are returned. | At Risk |
Filter | Optional | The filter expression used to refine results beyond the provided parameters. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported. | appDisplayName eq 'powerbIlab' |
Risk Level | Optional | This parameter applies only to the Risk Detections and Risk Users event types. The detected risk level by which to filter risk detections. Available options are:
By default, all risk detections regardless of their risk level are returned. | High |
Risk Event Type | Optional | This parameter applies only to the Risk Detections event type. The detected risk event type by which to filter events. By default, all events regardless of their risk event type are returned. | User reported suspicious activity |
Output
To view the sample output data for all commands, refer to this article.
Fetch Event Field Mapping
Fetch Event commands require event field mapping. Field mapping plays a key role for data normalization within the event pipeline. Field mapping converts the original data fields from the different providers to standardized D3 fields as defined by the D3 Model. Refer to Event and Incident Intake Field Mapping for details.
To add a custom field, click on the + Add Field button. Users can also remove built-in field mappings by clicking x. Note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.
The Microsoft Entra ID Protection integration in D3 SOAR has some pre-configured field mappings for Sign-in Logs, Risk Detections, and Risk Users which correspond to the Default Event Source, Event Source for Risk Detection, and Event Source for Risk User mappings:
Default Event Source
The Default Event Source is the default set of field mappings that are applied when this fetch event command is executed. For out-of-the-box integrations, users will find a set of field mappings provided by the system. Default event source provides field mappings for common fields from the fetched data. The default event source has a "Main Event JSON Path" (i.e. $.value) that is used to extract a batch of events from the response raw data. View the "Main Event JSON Path" by clicking on the Edit Event Source button.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
Main Event JSON Path: $.value
The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.
For example, the root node of a JSON Path is value. The child node denoting the Unique Event Key field would be id. Putting it together, the JSON Path expression to extract the Unique Event Key is $.value.id.
Event Source for Risk Detection
The D3 system configures the additional field mapping for the fields which are specific to events categorized as Risk Detection-related. In the response raw data, the event source Search String will be {eventType}=riskDetection. Click Edit Event Source to view the Search String.
Note: The Event Source for Risk Detection field mapping will be applied in addition to the Default Event Source field mapping for Risk Detection-related events.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
Event Source for Risk User
The D3 system configures the additional field mapping for the fields which are specific to events categorized as Risk User-related. In the response raw data, the event source Search String will be {eventType}=riskUser. Click Edit Event Source to view the Search String.
Note: The Event Source for Risk User field mapping will be applied in addition to the Default Event Source field mapping for Risk User-related events.
.png?inst-v=e8d251d2-3abc-496e-9d3c-aefadc694494)
The pre-configured field mappings are detailed below:
Field Name | Source Field |
Default Event Source (Main Event JSON Path: $.value) | |
Device ID | .deviceDetail.deviceId |
Device Is Compliant | .deviceDetail.isCompliant |
Error Code | .status.errorCode |
Failure Reason | .status.failureReason |
Home Tenant ID | .homeTenantId |
Is Interactive | .isInteractive |
Latitude | .location.geoCoordinates.latitude |
Longitude | .location.geoCoordinates.longitude |
Network Name | .networkLocationDetails..networkNames[*] |
Network Type | .networkLocationDetails..networkType |
Resource ID | .resourceId |
Resource Name | .resourceDisplayName |
Resource Tenant ID | .resourceTenantId |
Risk Detail | .riskDetail |
Risk Event Type | .riskEventTypes_v2 |
Risk Level During Sign In | .riskLevelDuringSignIn |
Risk State | .riskState |
Aggregated Risk Level | .riskLevelAggregated |
App ID | .appId |
Authentication Requirement | .authenticationRequirement |
Browser | .deviceDetail.browser |
City | .location.city |
Client App | .clientAppUsed |
Conditional Access Policy Names | .appliedConditionalAccessPolicies.displayName |
Conditional Access Status | .conditionalAccessStatus |
Country Or Region | .location.countryOrRegion |
State Or Province | .location.state |
User ID | .userId |
User Principal Name | .userPrincipalName |
User Type | .userType |
App | .appDisplayName |
Device | .deviceDetail.displayName |
Unique Event Key | .id |
Event Type | .signInEventTypes |
HTTP user agent | .userAgent |
Start Time | .createdDateTime |
Description | .status.additionalDetails |
Operating system | .deviceDetail.operatingSystem |
Source IP address | .kvp_info[?(@.key.text=='json.source_address')].value.text |
Status | .status.Status |
Username | .userDisplayName |
Event Source for Risk Detection (Search String: {$.eventType}=riskDetection) | |
Username | .userDisplayName |
Activity | .activity |
Severity | .riskLevel |
Source vendor name | .source |
Source IP address | .ipAddress |
Start Time | .detectedDateTime |
Unique Event Key | .id |
Event Type | .riskEventType |
User ID | .userId |
User Principal Name | .userPrincipalName |
Detection Timing Type | .detectionTimingType |
Risk State | .riskState |
Event Source for Risk User (Search String: {$.eventType}=riskUser) | |
Unique Event Key | .id |
Risk State | .riskState |
Severity | .riskLevel |
Username | .userDisplayName |
User Principle Name | .userPrincipalName |
Risk Detail | .riskDetail |
Risk Last Update | .riskLastUpdatedDateTime |
Error Handling
If the Return Data displays Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Fetch Event failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Azure AD Identity Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 403. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: You must have a valid Support account to call this API. |
Error Sample Data Fetch Event failed. Status Code: 403. Message: You must have a valid Support account to call this API. |
List History
Retrieves historical information on the specified risky Users IDs.
READER NOTE
Risky User ID is a required parameter to run this command.
Run the List Risky Users command to obtain the Risky User ID. Risky User IDs can be found under path $.value[*].id in the returned raw data.
If only the Risk User ID parameter is defined, all historical information on the specified user will be returned.
Input
Input Parameter | Required/Optional | Description | Example |
Risky User ID | Required | The ID of the risky user for which to retrieve historical information. Risky User ID can be obtained using the List Risky Users command. | ********************** |
Filter | Optional | The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported. | riskLevel eq 'low' |
Top | Optional | The page size of the returned results. | 1 |
Select | Optional | The filter properties to list in the returned results. The valid input properties are id, isDeleted, isProcessing, riskLevel, riskState, riskDetail, riskLastUpdatedDateTime, userDisplayName, userPrincipalName and userId. | id |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List History failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Invalid filter clause. |
Error Sample Data List History failed. Status Code: 400. Message: Invalid filter clause |
List Risk Detections
Retrieves a list of the riskDetection objects and their properties.
READER NOTE
All Risk Detections will be returned if no input is defined.
Input
Input Parameter | Required/Optional | Description | Example |
Filter | Optional | The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported. | detectionTimingType eq 'offline' |
Top | Optional | The page size of the returned results. | 1 |
Select | Optional | The filter properties to list in the returned results. The valid input properties are id, isDeleted, isProcessing, riskLevel, riskState, riskDetail, riskLastUpdatedDateTime, userDisplayName and userPrincipalName. | id |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Risk Detections failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Invalid filter clause. |
Error Sample Data List Risk Detections failed. Status Code: 400. Message: Invalid filter clause. |
List Risky Users
Retrieves a list of the riskyUser objects and their properties.
READER NOTE
All Risky Users will be returned if no input is defined.
Input
Input Parameter | Required/Optional | Description | Example |
Filter | Optional | The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported. | riskLevel eq 'high' |
Top | Optional | The page size of the returned results. | 1 |
Select | Optional | The filter properties to list in the returned results. The valid input properties are id, isDeleted, isProcessing, riskLevel, riskState, riskDetail, riskLastUpdatedDateTime, userDisplayName and userPrincipalName. | id |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Risky Users failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Invalid filter clause. |
Error Sample Data List Risky Users failed. Status Code: 400. Message:Invalid filter clause. |
List Sign-In
Retrieves the Microsoft Entra ID user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.
READER NOTE
All Sign-Ins will be returned if no input is defined.
Input
Input Parameter | Required/Optional | Description | Example |
Filter | Optional | The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported. | appDisplayName eq 'powerbIlab' |
Top | Optional | The page size of the returned results. | 1 |
Output
To view the sample output data for all commands, refer to this article.
Error Handling
If the Return Data is Failed, an Error tab will appear in the Test Result window.
The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | List Sign-In failed. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: Invalid filter clause. |
Error Sample Data List Sign-In failed. Status Code: 400. Message: Invalid filter clause. |
Test Connection
Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.
Input
N/A
Output
Output Type | Description | Return Data Type |
Return Data | Indicates one of the possible command execution states: Successful or Failed. The Failed state can be triggered by any of the following errors:
More details about an error can be viewed in the Error tab. | String |
Error Handling
If the Return Data is failed, an Error tab will appear in the Test Result window.
The error tab contains the responses from the third-party API calls including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.
Parts in Error | Description | Example |
Failure Indicator | Indicates the command failure that happened at a specific input and/or API call. | Test Connection failed. Failed to check the connector. |
Status Code | The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details. | Status Code: 400. |
Message | The raw data or captured key error message from the integration API server about the API request failure. | Message: unauthorized_client. |
Error Sample Data Test Connection failed. Failed to check the connector. Status Code: 400. Message: unauthorized_client. |