Microsoft Graph Logs connector FAQ
This feature is in Beta. To use it, a workspace admin must turn on Lakeflow Connect for Microsoft Graph Logs from the Previews page. See Manage Databricks previews.
This page answers frequently asked questions about the managed Microsoft Graph Logs ingestion connector in Lakeflow Connect. For FAQs that apply to all managed connectors, see Managed connector FAQs.
Which tables does the connector support?
The connector supports the security_alerts table, which contains alerts from the Microsoft Graph security API. See Destination table schemas.
How far back can the connector ingest data?
The first sync ingests alerts updated in the previous 180 days, unless you set the start_datetime option. See Connector options. Each later sync ingests alerts updated after the last run. Microsoft Graph returns only alerts within your environment's retention period.
Does the connector ingest changes to existing alerts?
Yes. The connector uses lastUpdateDateTime as the cursor, so each sync ingests alerts that changed since the last run, such as status or classification changes. The destination table keeps the latest version of each alert, keyed on id.
Which authentication methods does the connector support?
The connector supports OAuth machine-to-machine (M2M) authentication with the client ID and client secret of a Microsoft Entra ID application. OAuth user-to-machine (U2M) and basic authentication aren't supported.
Which Microsoft clouds does the connector support?
The connector supports the global service, including Government Community Cloud (GCC), and the US Government GCC High and Department of Defense (DoD) clouds. Set the Microsoft cloud value on the connection to match your tenant.