Skip to main content
Skip table of contents

Microsoft Entra ID Protection (Azure AD Identity Protection)

LAST UPDATED: JUNE 24, 2025

Overview

Microsoft Entra ID Protection is a security tool that detects, investigates and remediates identity-based risks in organizational environments. The collection of Microsoft Graph APIs enables users to query risks detected by identity protection.

D3 SOAR is providing REST operations to function with Microsoft Entra ID Protection.

Microsoft Entra ID Protection is available for use in:

D3 SOAR

V14.0.130.0+

Category

Endpoint Protection

Deployment Options

Option II, Option IV

Connection

To connect to Microsoft Entra ID Protection from D3 SOAR, please follow this part to collect the required information below:

Parameter

Description

Example

Server URL

The Microsoft Entra ID Protection server URL for the connection.

https://graph.microsoft.com

Auth URL

The auth URL to authenticate the connection. The input URL is https://login.microsoftonline.com/{<tenant_id>}/oauth2/v2.0/token. Replace <tenant_id> with your tenant ID.

https://login.microsoftonline.com/{{tenant_id}}/oauth2/v2.0/token

Api Version

The version of the API to use for the connection. The default value is v1.0.

v1.0

Grant Type

The grant type to authenticate the API connection. Only the client_credentials grant type is supported.

client_credentials

Client ID

The client ID to authenticate the API connection.

9c8**************f8a

Client Secret

The client secret to authenticate the API connection.

8lE***************vbh

Scope

The scope for the API connection. This is a fixed default value. No input action is required.

https://graph.microsoft.com/.default

Permission Requirements

Each endpoint in the Microsoft Entra ID Protection API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command

Required Permission

Confirm Compromised

IdentityRiskyUser.ReadWrite.All

Dismiss Risky User

IdentityRiskyUser.ReadWrite.All

Fetch Event

Permission requirements as organized by event type:

  • Sign-in Logs: AuditLog.Read.All, Directory.Read.All

  • Risk Detections: IdentityRiskEvent.Read.All

  • Risk Users: IdentityRiskyUser.Read.All

List History

IdentityRiskyUser.Read.All

List Risk Detections

IdentityRiskEvent.Read.All

List Risky Users

IdentityRiskyUser.Read.All

List Sign-In

AuditLog.Read.All and Directory.Read.All

Test Connection

No permission needed

READER NOTE

The permission list above is used for Application Permissions since the Grant Type is client_credential only. No Delegated permission is needed in this case.

Configuring Microsoft Entra ID Protection to Work with D3 SOAR

  1. Log in to the Azure Portal (https://portal.azure.com/).

  2. Navigate to the top search bar, then search and select App registrations.

  3. If you already have created apps, you can use one of them. Skip to step 5 to obtain the Client ID & Tenant ID. If you do not have an app, click + New registration to create one.

  4. Register the application.

    1. Enter an application Name.

    2. For Supported account types, select Accounts in this organizational directory only (<Your Directory Name> only - Single tenant).

    3. Click Register.

  5. In the App Overview tab, copy and save the Application(client) ID and Directory(tenant) ID. They will be required to build the integration connection in D3 SOAR. Navigate to Client credentials, then click Add a certificate or secret.

  6. Click + New Client Secret. Enter a Description for the client secret, and select a client secret expiry period using the Expires dropdown menu. Click Add. Note: The client ID will not be able to access the API resources after the client secret expires. You must renew the client secret to keep the client ID active.

  7. Copy and save the Secret Value. It will be required to build the integration connection in D3 SOAR connection. Note: The created Client Secret can only be viewed once. Store it in a secure location before leaving the page.

  8. Configure the API permissions. Click API permissions on the left navigation menu, then + Add a permission. Select Microsoft Graph, then search and select the required Application permissions. After selecting the required permissions, click Add permissions. See Permission Requirements for the required permissions for each command in this integration.

  9. Some permissions may need to be granted admin consent for your directory (d3uat in the sample screenshot) to use. Ensure Grant admin consent for <Your Directory> is checked.

You may see Not granted for <Your Directory> in the status column. Those are the ungranted permissions you want to use. After successfully granting permissions, a green checkmark will appear under the permission status column for the corresponding permissions. If your login account does not have admin privileges, ask your admin to grant consent.

Configuring D3 SOAR to Work with Microsoft Entra ID Protection

  1. Log in to D3 SOAR.

  2. Find the Microsoft Entra ID Protection integration.

    screenshot_1 (2).png
    1. Navigate to Configuration on the top header menu.

    2. Click on the Integration icon on the left sidebar.

    3. Type Microsoft Entra ID Protection in the search box to find the integration, then click it to select it.

    4. Click + Connection, on the right side of the Connections section. A new connection window will appear.

  3. Configure the following fields to create a connection to Microsoft Entra ID Protection.

    screenshot_2 (2).png
    1. Connection Name: The desired name for the connection.

    2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.

    3. Recipient site for events from connections Shared to Internal Sites: This field is displayed when Share to Internal Sites is selected for the Site field, allowing selection of the internal site for deploying the integration connection.

    4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.

    5. Description (Optional): Add a description for the connection.

    6. Tenant (Optional): When configuring the connection from a master tenant site, users have the option to choose the specific tenant sites to share the connection with. Once this setting is enabled, users can filter and select the desired tenant sites from the dropdowns to share the connection.

    7. Configure User Permissions: Defines which users have access to the connection.

    8. Active: Check the checkbox to ensure the connection is available for use.

      screenshot_3 (3).png
    9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
      1. Input the Auth URL. The input URL is https://login.microsoftonline.com/{<tenant_id>}/oauth2/v2.0/token. Replace <tenant_id> with your tenant ID. See step 5 of Configuring Microsoft Entra ID Protection to Work with D3 SOAR for instructions on obtaining the tenant ID.
      2. Input the API version. The default value is v1.0.
      3. Input the saved Client ID. See step 5 of Configuring Microsoft Entra ID Protection to Work with D3 SOAR.
      4. Input the saved Client Secret. See step 5 of Configuring Microsoft Entra ID Protection to Work with D3 SOAR for instructions on obtaining the tenant ID.
      Note: The Grant Type and Scope parameters do not require an input. The default values are fixed in order for the connection to pass.

    10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Refer to the password vault connection guide if needed.

    11. Connection Health Check: Periodically checks the connection status by scheduling the Test Connection command at the specified interval (in minutes). Available only for active connections, this feature also allows configuring email notifications for failed attempts.

  4. Test the connection.

    screenshot_4 (2).png
    1. Click on the Test Connection button to verify credentials and connectivity. A success alert displays Passed with a green checkmark. If the connection fails, review the parameters and retry.

    2. Click OK to close the alert window.

    3. Click + Add to create and add the configured connection.

Commands

Microsoft Entra ID Protection includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command function, users can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the Microsoft Entra ID Protection API, refer to the Microsoft Entra ID Protection API reference.

READER NOTE

Certain permissions are required for each command. Refer to the Permission Requirements and Configuring Microsoft Entra ID Protection to Work with D3 SOAR for details.

Confirm Compromised

Confirms one or more riskyUser objects as compromised. This action sets the targeted user's risk level to high.

READER NOTE

User IDs is a required parameter to run this command.

  • Run the List Risky Users command to obtain the User IDs. User IDs can be found under path $.value[*].id in the returned raw data.

Input

Input Parameter

Required/Optional

Description

Example

User IDs

Required

The IDs of the Users to confirm as compromised. User IDs can be obtained using the List Risky Users command.

JSON
[“**********************”]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Confirm Compromised failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 404.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: User IDs Not Found.

Error Sample Data

Confirm Compromised failed.

Status Code: 404.

Message: User IDs Not Found.

Dismiss Risky User

Dismisses the risk of one or more riskyUser objects. This action sets the targeted user's risk level to none.

READER NOTE

User IDs is a required parameter to run this command.

  • Run the List Risky Users command to obtain the User IDs. User IDs can be found under path $.value[*].id in the returned raw data.

Input

Input Parameter

Required/Optional

Description

Example

User IDs

Required

The IDs of the users for which to dismiss risk. User IDs can be obtained using the List Risky Users command.

JSON
[“**********************”]

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Dismiss Risky User failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 404.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: User IDs Not Found.

Error Sample Data

Dismiss Risky User failed.

Status Code: 404.

Message: User IDs Not Found.

Fetch Event

Retrieves Microsoft Entra ID sign-in logs, risk detections, or at risk user events and ingests them into D3 vSOC. For sign-in logs, it includes interactive user sign-ins (e.g., username/password authentication) and successful federated sign-ins. The logs are sorted by most recent sign-ins and limited events within the Azure AD default retention period. See How long does Microsoft Entra ID store the data? for details.

Input

Input Parameter

Required/Optional

Description

Example

Start Time

Optional

The start time (in UTC) to filter the returned events. By default, the Start Time is 24 hours before the End Time.

04/15/2024 01:00 AM

End Time

Optional

The end time (in UTC) to filter the returned events. By default, the End Time is the Current time.

04/16/2024 01:00 AM

Number of Event(s) Fetched

Optional

The maximum number of the most recent events to return. Valid values are integers between 1 and 100. By default, all events matching query parameters will be returned.

10

Event Type

Optional

The type of event to retrieve. Available options are:

  • Sign-in Logs

  • Risk Detections

  • Risk Users

By default, the value is Sign-in Logs.

Risk Detections

User Principal Names

Optional

The principal names of users for which to retrieve events. By default, all events regardless of their user principal name are returned.

JSON
[ "support@d3soar.com" ]

Risk Detail

Optional

The specific risk reason by which to filter events. By default, all events regardless of their risk detail are returned.

Admin Generated Temporary Password

Risk State

Optional

The specific risk state by which to filter events. Available options are:

  • Confirmed Safe

  • Remediated

  • Dismissed

  • At Risk

  • Confirmed Compromised

By default, all events regardless of their risk state are returned.

At Risk

Filter

Optional

The filter expression used to refine results beyond the provided parameters. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported.

appDisplayName eq 'powerbIlab'

Risk Level

Optional

This parameter applies only to the Risk Detections and Risk Users event types. The detected risk level by which to filter risk detections. Available options are:

  • High

  • Medium

  • Low

  • Hidden

  • None

By default, all risk detections regardless of their risk level are returned.

High

Risk Event Type

Optional

This parameter applies only to the Risk Detections event type. The detected risk event type by which to filter events. By default, all events regardless of their risk event type are returned.

User reported suspicious activity

Output

To view the sample output data for all commands, refer to this article.

Fetch Event Field Mapping

Fetch Event commands require event field mapping. Field mapping plays a key role for data normalization within the event pipeline. Field mapping converts the original data fields from the different providers to standardized D3 fields as defined by the D3 Model. Refer to Event and Incident Intake Field Mapping for details.

To add a custom field, click on the + Add Field button. Users can also remove built-in field mappings by clicking x. Note that two underscore characters will automatically prefix the defined Field Name as the System Name for a custom field mapping. Additionally, if an input Field Name contains any spaces, they will automatically be replaced with underscores for the corresponding System Name.

The Microsoft Entra ID Protection integration in D3 SOAR has some pre-configured field mappings for Sign-in Logs, Risk Detections, and Risk Users which correspond to the Default Event Source, Event Source for Risk Detection, and Event Source for Risk User mappings: 

  • Default Event Source

    The Default Event Source is the default set of field mappings that are applied when this fetch event command is executed. For out-of-the-box integrations, users will find a set of field mappings provided by the system. Default event source provides field mappings for common fields from the fetched data. The default event source has a "Main Event JSON Path" (i.e. $.value) that is used to extract a batch of events from the response raw data. View the "Main Event JSON Path" by clicking on the Edit Event Source button.

    Group 1 (4).png
    • Main Event JSON Path: $.value

      The Main Event JSON Path determines the root path where the system starts parsing raw response data into D3 event data. The JSON path begins with $, representing the root element. The path is formed by appending a sequence of child elements to $, each separated by a dot (.). Square brackets with nested quotation marks ([‘...’]) should be used to separate child elements in JSON arrays.

      For example, the root node of a JSON Path is value. The child node denoting the Unique Event Key field would be id. Putting it together, the JSON Path expression to extract the Unique Event Key is $.value.id.

  • Event Source for Risk Detection

    The D3 system configures the additional field mapping for the fields which are specific to events categorized as Risk Detection-related. In the response raw data, the event source Search String will be {eventType}=riskDetection. Click Edit Event Source to view the Search String.

    Note: The Event Source for Risk Detection field mapping will be applied in addition to the Default Event Source field mapping for Risk Detection-related events.

    Group 2 (2).png
  • Event Source for Risk User

    The D3 system configures the additional field mapping for the fields which are specific to events categorized as Risk User-related. In the response raw data, the event source Search String will be {eventType}=riskUser. Click Edit Event Source to view the Search String.

    Note: The Event Source for Risk User field mapping will be applied in addition to the Default Event Source field mapping for Risk User-related events.

    Group 3 (3).png

The pre-configured field mappings are detailed below:

Field Name

Source Field

Default Event Source (Main Event JSON Path: $.value)

Device ID

.deviceDetail.deviceId

Device Is Compliant

.deviceDetail.isCompliant

Error Code

.status.errorCode

Failure Reason

.status.failureReason

Home Tenant ID

.homeTenantId

Is Interactive

.isInteractive

Latitude

.location.geoCoordinates.latitude

Longitude

.location.geoCoordinates.longitude

Network Name

.networkLocationDetails..networkNames[*]

Network Type

.networkLocationDetails..networkType

Resource ID

.resourceId

Resource Name

.resourceDisplayName

Resource Tenant ID

.resourceTenantId

Risk Detail

.riskDetail

Risk Event Type

.riskEventTypes_v2

Risk Level During Sign In

.riskLevelDuringSignIn

Risk State

.riskState

Aggregated Risk Level

.riskLevelAggregated

App ID

.appId

Authentication Requirement

.authenticationRequirement

Browser

.deviceDetail.browser

City

.location.city

Client App

.clientAppUsed

Conditional Access Policy Names

.appliedConditionalAccessPolicies.displayName

Conditional Access Status

.conditionalAccessStatus

Country Or Region

.location.countryOrRegion

State Or Province

.location.state

User ID

.userId

User Principal Name

.userPrincipalName

User Type

.userType

App

.appDisplayName

Device

.deviceDetail.displayName

Unique Event Key

.id

Event Type

.signInEventTypes

HTTP user agent

.userAgent

Start Time

.createdDateTime

Description

.status.additionalDetails

Operating system

.deviceDetail.operatingSystem

Source IP address

.kvp_info[?(@.key.text=='json.source_address')].value.text

Status

.status.Status

Username

.userDisplayName

Event Source for Risk Detection (Search String: {$.eventType}=riskDetection)

Username

.userDisplayName

Activity

.activity

Severity

.riskLevel

Source vendor name

.source

Source IP address

.ipAddress

Start Time

.detectedDateTime

Unique Event Key

.id

Event Type

.riskEventType

User ID

.userId

User Principal Name

.userPrincipalName

Detection Timing Type

.detectionTimingType

Risk State

.riskState

Event Source for Risk User (Search String: {$.eventType}=riskUser)

Unique Event Key

.id

Risk State

.riskState

Severity

.riskLevel

Username

.userDisplayName

User Principle Name

.userPrincipalName

Risk Detail

.riskDetail

Risk Last Update

.riskLastUpdatedDateTime

Error Handling

If the Return Data displays Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Fetch Event failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Azure AD Identity Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 403.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: You must have a valid Support account to call this API.

Error Sample Data

Fetch Event failed.

Status Code: 403.

Message: You must have a valid Support account to call this API.

List History

Retrieves historical information on the specified risky Users IDs.

READER NOTE

  • Risky User ID is a required parameter to run this command.

    • Run the List Risky Users command to obtain the Risky User ID. Risky User IDs can be found under path $.value[*].id in the returned raw data.

  • If only the Risk User ID parameter is defined, all historical information on the specified user will be returned.

Input

Input Parameter

Required/Optional

Description

Example

Risky User ID

Required

The ID of the risky user for which to retrieve historical information. Risky User ID can be obtained using the List Risky Users command.

**********************

Filter

Optional

The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported.

riskLevel eq 'low'

Top

Optional

The page size of the returned results.

1

Select

Optional

The filter properties to list in the returned results. The valid input properties are id, isDeleted, isProcessing, riskLevel, riskState, riskDetail, riskLastUpdatedDateTime, userDisplayName, userPrincipalName and userId.

id

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List History failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid filter clause.

Error Sample Data

List History failed.

Status Code: 400.

Message: Invalid filter clause

List Risk Detections

Retrieves a list of the riskDetection objects and their properties.

READER NOTE

All Risk Detections will be returned if no input is defined.

Input

Input Parameter

Required/Optional

Description

Example

Filter

Optional

The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported.

detectionTimingType eq 'offline'

Top

Optional

The page size of the returned results.

1

Select

Optional

The filter properties to list in the returned results. The valid input properties are id, isDeleted, isProcessing, riskLevel, riskState, riskDetail, riskLastUpdatedDateTime, userDisplayName and userPrincipalName.

id

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List Risk Detections failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid filter clause.

Error Sample Data

List Risk Detections failed.

Status Code: 400.

Message: Invalid filter clause.

List Risky Users

Retrieves a list of the riskyUser objects and their properties.

READER NOTE

All Risky Users will be returned if no input is defined.

Input

Input Parameter

Required/Optional

Description

Example

Filter

Optional

The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported.

riskLevel eq 'high'

Top

Optional

The page size of the returned results.

1

Select

Optional

The filter properties to list in the returned results. The valid input properties are id, isDeleted, isProcessing, riskLevel, riskState, riskDetail, riskLastUpdatedDateTime, userDisplayName and userPrincipalName.

id

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List Risky Users failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid filter clause.

Error Sample Data

List Risky Users failed.

Status Code: 400.

Message:Invalid filter clause.

List Sign-In

Retrieves the Microsoft Entra ID user sign-ins for your tenant. Sign-ins that are interactive in nature (where a username/password is passed as part of auth token) and successful federated sign-ins are currently included in the sign-in logs.

READER NOTE

All Sign-Ins will be returned if no input is defined.

Input

Input Parameter

Required/Optional

Description

Example

Filter

Optional

The filter expression used to refine results. Use Microsoft Graph syntax: <property> <operator> <value>. Refer to SignIn resource properties and filter operators for supported values. Logical operators and and or are also supported.

appDisplayName eq 'powerbIlab'

Top

Optional

The page size of the returned results.

1

Output

To view the sample output data for all commands, refer to this article.

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

List Sign-In failed.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: Invalid filter clause.

Error Sample Data

List Sign-In failed.

Status Code: 400.

Message: Invalid filter clause.

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Output Type

Description

Return Data Type

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

  • A connection issue with the integration

  • The API returned an error message

  • No response from the API

More details about an error can be viewed in the Error tab.

String

Error Handling

If the Return Data is failed, an Error tab will appear in the Test Result window.

The error tab contains the responses from the third-party API calls including Failure Indicator, Status Code, and Message. This can help locate the root cause of a command failure.

Parts in Error

Description

Example

Failure Indicator

Indicates the command failure that happened at a specific input and/or API call.

Test Connection failed. Failed to check the connector.

Status Code

The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the Microsoft Entra ID Protection portal. Refer to the HTTP Status Code Registry for details.

Status Code: 400.

Message

The raw data or captured key error message from the integration API server about the API request failure.

Message: unauthorized_client.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 400.

Message: unauthorized_client.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.