Cisco Security and Microsoft Entra ID

Microsoft Entra ID (formerly known as Microsoft Azure Active Directory or Azure AD) is a cloud-based identity and access management (IAM) solution. It is a directory and identity management service that operates in the cloud and offers authentication and authorization services to various Microsoft services, such as Microsoft 365, Dynamics 365, Microsoft Azure and third-party services. Entra ID provides users with single sign-on experience, regardless of whether their applications are cloud-based or on-premises.

Product Integrations

Cisco XDR

When you configure the Microsoft Entra ID integration, data about your Entra users will become available in the Cisco XDR assets feature. This information is then used to enrich investigations and enhance incident triage with user context. A target will also become available in XDR automation for automated workflows.

Cisco XDR Investigate: This integration will enhance investigations with user information from Entra ID.

Cisco XDR Assets: This integration can also be used to provide user information, for use in triaging incidents and detections. 

Cisco XDR Automate: This integration can run automations to enable or disable users as response actions. 

• Microsoft Entra ID - Disable User
• Microsoft Entra ID - Enable User