search

microsoft / msticpy

Microsoft Threat Intelligence Security Tools
Other
1.76k stars 318 forks source link

Username & Password authentication to M365D/MDE as same as Azure Sentinel #721

Closed Tatsuya-hasegawa closed 9 months ago

Tatsuya-hasegawa commented 1 year ago

Is your feature request related to a problem? Please describe. I want to connect M365D by using username and password not the client secret string of Azure Enterprise App. Because it cannot distinguish source user and creating the App spends time to go ahead.

Describe the solution you'd like Implementation another auth method to M365D as same as Azure Sentinel's auth_method="env". https://msticpy.readthedocs.io/en/latest/getting_started/AzureAuthentication.html

Describe alternatives you've considered GraphSDK can be used to M365D. Is it on your dev line ?
https://learn.microsoft.com/en-us/graph/sdks/sdks-overview

Additional context I'm happy if I receive any reply. :) Thank you in advance.

ianhelle commented 11 months ago

So, the second of these - Joey Dreyer has just submitted a PR for the graph-based M365D access. This should go in soon.

It used to be the case that M365D/MDE (when we first wrote the driver) would only accept client_id/client_secret. I think this should be possible but still all of the examples I see with both legacy and graph-based hunting APIs are using client secret credentials explicitly.

If you have any better/deeper knowledge of this I'd be very happy to receive this.

Tatsuya-hasegawa commented 11 months ago

Thank you for the reply.

Unfortunately, I don't have any knowledge to handle it at the present. I'll keep tracking this theme with low priority.