> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/microsoft-sentinel.md). # Microsoft Sentinel Data Exploration Connect Microsoft Sentinel to Cakewalk's MCP Gateway through Sentinel's Data Exploration MCP server. Every agent tool call against Sentinel passes through the gateway and is evaluated against your company's Policies. Cakewalk connects through a Microsoft Entra app that your company registers once and reuses for every Microsoft connection. Your admin registers the app, enables the Azure Resource Manager and Sentinel Platform Services APIs in the tenant, grants the app delegated access to both, and grants admin consent. Employees then sign in with their own accounts, so every call runs with that person's own Sentinel access. {% hint style="info" %} This connection reuses the same Entra app as the Microsoft 365 connections. If you already registered `CakewalkMcpClient` for Calendar, Mail, OneDrive, SharePoint, Teams or Word, skip Step 1 and start at [Step 2](#step-2-enable-the-sentinel-mcp-apis-in-your-tenant-one-time). {% endhint %} ## Requirements * A Microsoft Sentinel data lake. Most Sentinel MCP tools require your tenant to be onboarded to the data lake. * The **Security reader** role at minimum, to list and invoke the Sentinel MCP tools. * A Microsoft Entra administrator with tenant level privileges who can register an app, run the Azure CLI and grant admin consent. * The Azure CLI installed on the administrator's machine. * A Cakewalk Admin who can enable the Connection. ## Step 1: Register the Cakewalk Entra app (one time) 1. Go to the [Azure portal](https://portal.azure.com) and open **Microsoft Entra ID**. 2. Go to **App registrations** and select **New registration**. 3. Give it a name, for example `CakewalkMcpClient`. 4. Under supported account types, select **Accounts in this organizational directory only** (single tenant). 5. Under **Redirect URI**, choose type **Web** and enter: ``` https://mcp-gateway.getcakewalk.io/api/v1/Auth/Callback ``` 6. Select **Register**. 7. Open **Overview** and copy the **Application (client) ID** and the **Directory (tenant) ID**. 8. Open **Certificates & secrets**, select **New client secret**, give it a name and expiry, and copy the secret **Value** now. You cannot read it again later. ## Step 2: Enable the Sentinel MCP APIs in your tenant (one time) The Azure Resource Manager and Sentinel Platform Services APIs must be present in your tenant before you can grant permissions to them. Sign in with the Azure CLI and create a service principal for each: ``` az login --tenant {your_tenant_id} az ad sp create --id 22bfbae3-f4e7-485f-be43-8cee15065084 az ad sp create --id 4500ebfb-89b6-4b14-a480-7f749797bfcd ``` Once the service principals exist, both APIs appear when you search under **APIs my organization uses** in Step 3. ## Step 3: Add the Sentinel permissions In the same Entra app: 1. Open **API permissions**, select **Add a permission**, then **APIs my organization uses**. 2. Search for **ARM**. Select the delegated permission **`MCP.Access`** and add it. 3. Select **Add a permission** again, then **APIs my organization uses**. 4. Search for **Sentinel Platform Services**. Select the delegated permission **`SentinelPlatform.DelegatedAccess`** and add it. 5. Select **Grant admin consent** for your tenant. ## Step 4: Connect from Cakewalk 1. Sign in to Cakewalk as an Admin at . 2. Go to **All Connections** and select **Add org connection > Choose from catalog**. 3. Select **Microsoft Sentinel Data Exploration**. 4. Enter the **Directory (tenant) ID**, **Application (client) ID** and **client secret** you copied in Step 1. ## Verifying it works From an agent platform connected to Cakewalk, ask the agent to run a simple Sentinel query. If Sentinel returns results, the connection is live. In Cakewalk, the Microsoft Sentinel Data Exploration card on **All Connections** shows as active. ## Learn more * [Get started with the Microsoft Sentinel MCP server](https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-get-started) from Microsoft. * [Use the Microsoft Sentinel MCP connector in ChatGPT or Claude](https://learn.microsoft.com/en-us/azure/sentinel/datalake/sentinel-mcp-chatgpt-claude-connector) from Microsoft. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/connections-and-integrations/agent-connections/microsoft-sentinel.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.