Microsoft
Microsoft provides two primary gateways for interacting with its cloud services: Microsoft Graph API and Azure Management API (ARM).
- Microsoft Graph is the unified entry point for data and intelligence across Microsoft 365 (Users, Teams, Outlook).
- Azure APIs are used for managing cloud infrastructure (Virtual Machines, Storage, Sentinel).
Think of Microsoft Graph as the API for people and their work, while Azure APIs are for the hardware and services running your environment.
Prerequisites for Setup
Section titled “Prerequisites for Setup”To begin interacting with any of these APIs, you must have:
- Admin or adequate role within Azure: Any setup will require you to interact with Azure Entra Applications.
- App Registration: A registered application in the Entra ID portal to obtain a Client ID and Tenant ID.
- Permissions: Appropriate “API Permissions” (for Graph) or “Role Assignments” (for Azure) granted to your application.
Navigating between Azure, Graph, and others
Navigating the ecosystem requires understanding the Audience (aud) of your token; a token for graph.microsoft.com will not work for management.azure.com. Developers must often manage multiple tokens if their workflow involves both user management (Graph) and infrastructure deployment (Azure).
Authentication is the process of proving your application’s identity to Microsoft Entra ID to receive an access token. It ensures that only registered and verified entities can initiate a request to the cloud.
Connecting to an Azure Blob Container
Connecting via Mindflow involves using a “Connector” that leverages Azure Storage APIs to automate file uploads or data processing. You will typically need your Storage Account name and either an Account Key or a Shared Access Signature (SAS) to establish the link.
The Teams API (part of Microsoft Graph) allows you to automate channel creation, post messages, and manage membership. It is essential for building bots or “ChatOps” workflows that integrate external triggers directly into a collaboration space.
Creating Subscriptions on Resources
The Change Notifications API is a powerful tool allowing users to subscribe to resources within their Microsoft tenant (Exhange, SharePoint, Teams, etc.). It is essential for allowing users to create workflows reacting on dynamic events happening within their Microsoft tenant.
KQL is the read-only query language used to explore large datasets in Azure Monitor, Log Analytics, and Sentinel. It is the “SQL of the Microsoft Cloud,” enabling you to filter, aggregate, and visualize security and performance data with high speed.
OData parameters like $filter, $select, and $expand allow you to fine-tune API responses to get only the data you need. Using these parameters reduces network overhead and improves application performance by preventing “over-fetching” of data.
Azure Sentinel (Microsoft Sentinel) uses its own set of APIs to manage security incidents, run hunting queries, and automate threat responses. While it can be accessed via the Azure Management API, many of its security-specific logs are also exposed through the Microsoft Graph Security API.
Microsoft Purview Audit Log Queries
Microsoft provides companies with Purview Unified Audit Log (UAL) capabilities to allow them to, besides Purview’s capabilities, to define and run fine-grained queries across their whole Microsoft tenant.
Microsoft SharePoint (Files & Sites)
Microsoft Graph provides access to SharePoint sites, drives (document libraries), and files, enabling you to navigate folders, list/download/upload documents, and automate content workflows. Start with prerequisites (authentication, scopes, Site ID), then follow the navigation/file ops and Excel pages depending on your use case.