Azure Activities

Connect Azure Activities to Radiant Security to forward subscription-level events for AI triage.

Azure Activities are the subscription-level resource events generated by Microsoft Azure, covering provisioning changes, role assignments, policy updates, and other administrative actions. Enabling the Azure Activities data feed on your existing Microsoft O365 connector forwards these events to Radiant Security.

For background on Azure activity logging, see Azure activity log in the Microsoft documentation.

The Microsoft O365 connector already holds the Application (client) ID, Directory (tenant) ID, and Client Secret Value from initial onboarding. This article walks through the additional Azure-side configuration required for Azure Activities and the Subscription IDs you provide to Radiant when enabling the data feed.

Prerequisites

• Admin access to Azure
• An existing Microsoft O365 connector in Radiant Security

Register the application in Microsoft Entra ID

1. Sign in to the Microsoft Azure Portal.
2. From the left side menu, navigate to Microsoft Entra ID.
3. From the left menu, navigate to App Registrations.
4. Click + New Registration.

1. Set the application Name to radiantsecurity-connector and leave all default settings unchanged.

1. Click Register to save the changes.
2. On the newly registered application page, copy the following values:

   • Application (client) ID
   • Directory (tenant) ID

1. On the same page, click the link for Add a certificate or secret.

1. In the Certificates & secrets pane, click + New client secret.
2. Set the client secret as follows:

   • Description: Radiant Security Connector
   • Expires: 12 months

1. Click Add.
2. On the client secrets page that opens, copy the Value (not the Secret ID field).

Copy the Client Secret Value now. It cannot be retrieved later.

Grant API permissions to the registered application

1. On the left sidebar menu, click API Permissions.
2. Click + Add a permission.
3. From the pop-out menu, select Azure Service Management.

1. Select the user_impersonation permission.

1. Click Add permissions.

Assign the Reader role for each subscription

Each Azure subscription that should be monitored requires its own Reader role assignment for the registered application. Repeat the steps below for each subscription.

1. Open the Subscriptions page and select the subscription to configure.

1. From the left menu, click Access control (IAM).
2. Click + Add, then select Add role assignment.

1. On the Role page, search for and select Reader. Click Next.

1. On the Members page, click + Select members and search for radiantsecurity-connector.

1. Select the application, then click Select at the bottom of the pane.
2. Click Next, then click Review + Assign to confirm the role.

Enable the Azure Activities data feed in Radiant Security

1. Sign in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors.
3. Click View Details on the Microsoft O365 data connector.
4. Under Optional - Azure subscription IDs (comma separated), enter each subscription ID from your Azure Reader role assignments, separated by commas with no spaces after the commas.
5. Locate the row for the Azure Activities data feed under your existing Microsoft O365 connector.
6. On the right side of the row, click Enable.

Verify ingestion

After Azure Activities begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"ms365_azure_activity".
3. Confirm recent events appear.

Allow several minutes for events to be parsed, indexed, and available for search.