Microsoft

• Microsoft Configuration
• Microsoft Schema
• Microsoft Examples
• Microsoft Analysis

The microsoft module is the top-level umbrella for Microsoft tenant, SaaS, and security control plane data ingested via Microsoft Graph. It includes:

• entra: Entra ID identity objects (users, groups, OUs, applications, service principals, and app role assignments)

• intune: Intune managed devices, detected apps, and compliance policies

• o365: Office 365 licensing (subscribed SKUs, service plans, and per-user license assignments)

microsoft is the canonical top-level module name. entra remains accepted as a backward-compatible alias for module selection and ontology source configuration during the migration.

Microsoft and Azure ingestion share AzureTenant as the primary tenant node. Microsoft Graph ingestion also adds the EntraTenant compatibility label to that node.

See the configuration docs, schema, example queries, and analysis behavior for details.