Microsoft Graph Logs connector

Beta

This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Graph Logs from the Previews page. See Manage Databricks previews.

The managed Microsoft Graph Logs connector in Lakeflow Connect ingests security alerts from the Microsoft Graph security API into Databricks, including alerts from Microsoft Defender XDR and Microsoft Sentinel.

Feature availability

Feature	Availability
UI-based pipeline authoring	Supported
API-based pipeline authoring	Supported
Declarative Automation Bundles	Supported
Incremental ingestion	Supported
Unity Catalog governance	Supported
Orchestration using Lakeflow Jobs	Supported
API-based column selection and deselection	Supported
API-based row filtering	Not supported
SCD Type 2	Not supported
Automated schema evolution: New and deleted columns	Supported
Automated schema evolution: Data type changes	Not supported
Automated schema evolution: Column renames	Supported Treated as a new column (new name) and deleted column (old name).

Feature	Availability
UI-based pipeline authoring	Supported
API-based pipeline authoring	Supported
Declarative Automation Bundles	Supported
Incremental ingestion	Supported
Unity Catalog governance	Supported
Orchestration using Lakeflow Jobs	Supported
API-based column selection and deselection	Supported
API-based row filtering	Not supported
SCD Type 2	Not supported
Automated schema evolution: New and deleted columns	Supported
Automated schema evolution: Data type changes	Not supported
Automated schema evolution: Column renames	Supported Treated as a new column (new name) and deleted column (old name).

Authentication methods

Authentication method	Availability
OAuth U2M	Not supported
OAuth M2M	Supported Client ID and client secret of a Microsoft Entra ID application.
Basic authentication (username/password)	Not supported

Authentication method	Availability
OAuth U2M	Not supported
OAuth M2M	Supported Client ID and client secret of a Microsoft Entra ID application.
Basic authentication (username/password)	Not supported

What to know before you start

note

Before starting, review the Databricks user persona, supported interfaces, ingestion frequency, and common patterns.

Start ingesting from Microsoft Graph

1. Configure Microsoft Graph for ingestion (Admins). Set up Microsoft Graph to authenticate with Databricks.
2. Create a Unity Catalog connection (Admins). Create a connection in Catalog Explorer so non-admins can create pipelines.
3. Create an ingestion pipeline (Admins or non-admins). Select any supported interface and create a pipeline from an existing connection.