New feature
Beta
Microsoft Graph Logs connector
Microsoft Graph Logs connector is a Databricks data engineering capability, introduced October 2026.
A managed Lakeflow Connect connector that ingests security alerts from the Microsoft Graph security API, including alerts from Microsoft Defender XDR and Microsoft Sentinel, into Databricks.
- Despite the name, it does not ingest the Graph: it reads one corner of it, the security API, and lands the alerts as tables.
- No human ever signs in: the only supported method is OAuth M2M with the client ID and secret of a Microsoft Entra ID application.
Limitations: Beta, turned on from the Previews page. OAuth M2M (Microsoft Entra ID app) only; no SCD Type 2, no API-based row filtering, no schema evolution for data type changes, and a column rename lands as a new column plus a deleted one.
Open in REbricked →- Category
- Data engineering
- Also known as
- Microsoft Graph Logs, Microsoft Graph security API, Microsoft Defender XDR alerts, Microsoft Sentinel alerts
- Verified
- 2026-10-30