> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/deploy/crowdstrike/add-on/itp.md). # ITP with Entra ID Connect each Entra ID tenant to CrowdStrike Identity Threat Protection (ITP) by creating an Azure registration from your Falcon console. At the end, you email Stoïk your tenant ID so monitoring can be activated. ## Prerequisites * A **Microsoft Entra ID P1 or P2** licence. Microsoft Entra ID Free is not supported. * An **Azure subscription** in the tenant. CrowdStrike deploys its log ingestion resources there. * A person with the **Global Administrator** or **Privileged Role Administrator** role in Entra ID, to grant admin consent. * A person with the **Owner** and **Azure Deployment Stack Owner** Azure roles at the **Tenant Root Group** level, to deploy the resources. * A **Falcon console account** with the permissions to set up the connector. Stoïk creates it for you in step 1. {% hint style="warning" %} The Global Administrator role in Entra ID does **not** grant the Azure roles above. They must be assigned explicitly at the Tenant Root Group level, otherwise the deployment fails. {% endhint %} ## Purpose of ITP ITP continuously monitors account activity and Active Directory to detect abnormal behaviour. * **Identity-centred behavioural analysis:** detects suspicious authentications, unusual access patterns, unauthorised login attempts and user account anomalies. Examples include suspicious workstation-to-server connections, network scans, brute-force attempts and credential extraction. The module can automatically block critical events. * **Active Directory security posture:** gives a real-time view of AD security, with more advanced options than the Stoïk Protect AD scan. It identifies configuration issues, accounts with compromised passwords and privilege management problems. * **Cloud threat monitoring (optional):** once Entra ID is connected, ITP ingests your cloud and hybrid accounts, Entra ID audit logs, sign-in logs and Azure activity logs. It correlates SSO activity with your on-premises accounts and detects logins from suspicious IP addresses and abnormal access attempts. ## Integration CrowdStrike changed this integration in 2026: the Entra ID connector is now set up as an **Azure registration** in Falcon Cloud Connectors. You no longer create an application, a client secret or a custom role by hand. If you already set up the previous connector, see [Migrating from the legacy connector](#migrating-from-the-legacy-connector). You run the whole setup yourself from your Falcon console, for **each Entra ID tenant**. Stoïk gives you the access you need and checks the result. **No secret is exchanged with Stoïk**: you generate the CrowdStrike API credentials in the console and only use them in your own Azure Cloud Shell. Ideally, the same person runs steps 3 to 6 and holds both the Entra ID and Azure roles above. Otherwise, plan a short session with the people concerned: the wizard must stay open from step 3 to step 6.
Who does what
StepWho
1. Get your Falcon console accessYou and Stoïk
2. Check your Azure rolesYou (Azure administrator)
3. Create the Azure registration in FalconYou
4. Grant admin consentYou (Global Administrator or Privileged Role Administrator)
5. Deploy the resources from Azure Cloud ShellYou (Azure administrator)
6. Complete and confirm the registrationYou, then Stoïk
7. Grant remediation access to StoïkYou (Global Administrator)
{% stepper %} {% step %} ### Get your Falcon console access 1. Email with the **name and email** of the person who will run the setup. 2. Stoïk creates a Falcon user account for this person, with the permissions needed to configure the Entra ID connector. 3. The person receives an activation email from CrowdStrike. They set their password and **MFA**, then sign in to the [Falcon console](https://falcon.eu-1.crowdstrike.com). {% endstep %} {% step %} ### Check your Azure roles The person running the deployment opens [Azure Cloud Shell](https://shell.azure.com) in **Bash** mode and runs: ```bash az role assignment list \ --assignee $(az ad signed-in-user show --query id -o tsv) \ --scope "/providers/Microsoft.Management/managementGroups/$(az account show --query tenantId -o tsv)" \ --include-groups \ --query "[?roleDefinitionName=='Owner' || roleDefinitionName=='Azure Deployment Stack Owner'].{Role:roleDefinitionName, Scope:scope}" \ -o table ``` The output must list both **Owner** and **Azure Deployment Stack Owner**. If either role is missing, have it assigned at the Tenant Root Group level before you continue.
Can't see or manage the Tenant Root Group A Global Administrator must first enable `Access management for Azure resources` in `Entra ID` > `Properties`. This gives them the right to assign the roles above. You can turn it off again afterwards.
{% endstep %} {% step %} ### Create the Azure registration in Falcon Before you start, copy from your Microsoft consoles: * the `Tenant ID`: [Microsoft Entra admin center](https://entra.microsoft.com) > `Entra ID` > `Overview` * the `Subscription ID` where CrowdStrike resources will be deployed: [Azure portal](https://portal.azure.com) > `Subscriptions` Then, in the Falcon console: 1. **Open the wizard:** * If you have a legacy Entra ID connector, go to `Identity protection` > `Settings` > `Configurations` > `Connectors` and click **Upgrade Now** on it. The wizard opens with your tenant pre-filled. * Otherwise, go to `Connectors` > `Cloud connectors` > `Cloud connections`, open the `Azure` tab and click **Add new registration**. If prompted, select **New deployment methods**, then **Next**. 2. **Registration parameters:** enter a registration name, your `Microsoft Entra tenant ID`, select `Bicep` and enter the `Subscription ID`. Click **Continue with standard setup**. 3. **Features:** select `Real-time visibility and detection`, then **Next**. 4. **Advanced settings:** leave `I want to customize Entra ID permissions` unchecked. Change the region for log ingestion resources only if needed. Click **Next**. 5. **API credentials:** click **Generate API client**. Copy the `Client ID` and `Client secret` and keep them at hand for step 5. The secret is shown only once. Click **Done**, then **Next**. {% hint style="warning" %} Keep the client secret to yourself. Never send it by email, chat or ticket, including to Stoïk. You only need it in Azure Cloud Shell during step 5. {% endhint %} {% endstep %} {% step %} ### Grant admin consent Run by a Global Administrator or Privileged Role Administrator. Without admin consent, Falcon cannot read Entra ID data and Identity Protection will not work. 1. On the `Deploy configuration` page of the wizard, click **Grant admin consent** and sign in with your Microsoft administrator account. 2. Check that the **tenant ID in the URL matches your tenant**. 3. Review the requested permissions and click **Accept**. 4. Back in the wizard, click **Verify**. The application created by CrowdStrike only has **read-only** permissions on your directory. {% endstep %} {% step %} ### Deploy the resources from Azure Cloud Shell 1. On the `Deploy configuration` page, open the `Bash` tab and click **Download ZIP** to get `crowdstrike-fcs-azure-bicep-generated.zip`. 2. In Azure Cloud Shell (Bash), upload the ZIP file. 3. Unzip it: ```bash unzip crowdstrike-fcs-azure-bicep-generated.zip ``` 4. Check that the parameters file is present: ```bash ls parameters.bicepparam ``` If the file isn't listed, check that you uploaded and unzipped the right file. 5. Copy the commands shown on the `Bash` tab and run them in order: * `az login -t ''` * `export FALCON_CLIENT_SECRET=` * `az stack mg create ...`, which deploys the Bicep template 6. Wait until the last command finishes. The terminal looks inactive while the deployment runs and only shows errors. This is normal. {% endstep %} {% step %} ### Complete and confirm the registration 1. In the wizard, click **Validate and complete**. 2. On the `Azure` tab of `Cloud connections`, the registration first shows `Pending`, then `Active`. Allow about **2 hours** for data to appear. 3. The registration is complete when both `Assets` and `Real-time visibility and detection` show `Active`. {% hint style="warning" %} Email with your tenant ID. Stoïk checks the registration and activates monitoring on its side. Without it, monitoring cannot be activated. {% endhint %} Once the registration is active, Stoïk removes the configuration permissions from your Falcon account. {% endstep %} {% step %} ### Grant remediation access to Stoïk If an account is compromised outside business hours, your team may be unavailable. Granting this access lets Stoïk disable affected accounts once a compromise is confirmed. 1. Sign in as a Global Administrator and open the [admin consent link](https://login.microsoftonline.com/organizations/adminconsent?client_id=72f25200-dfe6-4c66-959d-103731ae6215\&redirect_uri=https://login.microsoftonline.com/common/oauth2/nativeclient). 2. Review the requested permissions and click **Accept**. 3. You land on a blank page. You can close it.
What the remediation application can do The application can only enable or disable existing accounts. It cannot create accounts or change other attributes. Each action requires MFA, is logged and is timestamped. Stoïk can provide the full audit log on request.
{% endstep %} {% endstepper %} ## Migrating from the legacy connector If you set up the [previous Entra ID connector](/mdr/deploy/crowdstrike/add-on/itp-legacy.md) (application `stoik-connector-itp` with a client secret), it must be migrated: 1. Request your Falcon console access (step 1). 2. Complete steps 2 to 6. In step 3, start from **Upgrade Now** on the legacy connector. 3. Once the new registration is active, the legacy connector shows `Ready to Decommission`. Delete it in `Identity protection` > `Settings` > `Configurations` > `Connectors`, or ask Stoïk to do it. 4. You can then delete the old `stoik-connector-itp` application, its client secret and the `Identity Protection RBAC Reader` custom role from your tenant. They are no longer used. ## Self-managed Falcon console If you manage your own Falcon console, skip step 1 and use an account with the permissions to manage cloud registrations and API clients. Follow steps 2 to 7. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.stoik.io/mdr/deploy/crowdstrike/add-on/itp.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.