Microsoft Sentinel Data Exploration

Connect Microsoft Sentinel to Cakewalk through Sentinel's Data Exploration MCP server, using the Microsoft Entra app you register for Microsoft connections.

Connect Microsoft Sentinel to Cakewalk's MCP Gateway through Sentinel's Data Exploration MCP server. Every agent tool call against Sentinel passes through the gateway and is evaluated against your company's Policies.

Cakewalk connects through a Microsoft Entra app that your company registers once and reuses for every Microsoft connection. Your admin registers the app, enables the Azure Resource Manager and Sentinel Platform Services APIs in the tenant, grants the app delegated access to both, and grants admin consent. Employees then sign in with their own accounts, so every call runs with that person's own Sentinel access.

This connection reuses the same Entra app as the Microsoft 365 connections. If you already registered CakewalkMcpClient for Calendar, Mail, OneDrive, SharePoint, Teams or Word, skip Step 1 and start at Step 2.

Requirements

• A Microsoft Sentinel data lake. Most Sentinel MCP tools require your tenant to be onboarded to the data lake.

• The Security reader role at minimum, to list and invoke the Sentinel MCP tools.

• A Microsoft Entra administrator with tenant level privileges who can register an app, run the Azure CLI and grant admin consent.

• The Azure CLI installed on the administrator's machine.

• A Cakewalk Admin who can enable the Connection.

Step 1: Register the Cakewalk Entra app (one time)

1. Go to the Azure portal and open Microsoft Entra ID.

2. Go to App registrations and select New registration.

3. Give it a name, for example CakewalkMcpClient.

4. Under supported account types, select Accounts in this organizational directory only (single tenant).

5. Under Redirect URI, choose type Web and enter:

   https://mcp-gateway.getcakewalk.io/api/v1/Auth/Callback

6. Select Register.

7. Open Overview and copy the Application (client) ID and the Directory (tenant) ID.

8. Open Certificates & secrets, select New client secret, give it a name and expiry, and copy the secret Value now. You cannot read it again later.

Step 2: Enable the Sentinel MCP APIs in your tenant (one time)

The Azure Resource Manager and Sentinel Platform Services APIs must be present in your tenant before you can grant permissions to them. Sign in with the Azure CLI and create a service principal for each:

az login --tenant {your_tenant_id}
az ad sp create --id 22bfbae3-f4e7-485f-be43-8cee15065084
az ad sp create --id 4500ebfb-89b6-4b14-a480-7f749797bfcd

Once the service principals exist, both APIs appear when you search under APIs my organization uses in Step 3.

Step 3: Add the Sentinel permissions

In the same Entra app:

1. Open API permissions, select Add a permission, then APIs my organization uses.

2. Search for ARM. Select the delegated permission MCP.Access and add it.

3. Select Add a permission again, then APIs my organization uses.

4. Search for Sentinel Platform Services. Select the delegated permission SentinelPlatform.DelegatedAccess and add it.

5. Select Grant admin consent for your tenant.

Step 4: Connect from Cakewalk

1. Sign in to Cakewalk as an Admin at https://app.getcakewalk.io.

2. Go to All Connections and select Add org connection > Choose from catalog.

3. Select Microsoft Sentinel Data Exploration.

4. Enter the Directory (tenant) ID, Application (client) ID and client secret you copied in Step 1.

Verifying it works

From an agent platform connected to Cakewalk, ask the agent to run a simple Sentinel query. If Sentinel returns results, the connection is live. In Cakewalk, the Microsoft Sentinel Data Exploration card on All Connections shows as active.

Learn more

• Get started with the Microsoft Sentinel MCP server from Microsoft.

• Use the Microsoft Sentinel MCP connector in ChatGPT or Claude from Microsoft.