ITP with Entra ID

Don't forget the last part of step 6, Complete and confirm the registration: email Stoïk with your tenant ID. Without it, monitoring cannot be activated on our side.

CrowdStrike changed this integration in 2026. The Entra ID connector is now set up as an Azure registration in Falcon Cloud Connectors. You no longer create an application, a client secret or a custom role by hand. If you already set up the previous connector, see Migrating from the legacy connector.

Purpose of ITP

Identity Threat Protection (ITP) continuously monitors account activity and Active Directory to detect abnormal behaviour.

• Identity-centred behavioural analysis: detects suspicious authentications, unusual access patterns, unauthorised login attempts and user account anomalies. Examples include suspicious workstation-to-server connections, network scans, brute-force attempts and credential extraction. The module can automatically block critical events.

• Active Directory security posture: gives a real-time view of AD security, with more advanced options than the Stoïk Protect AD scan. It identifies configuration issues, accounts with compromised passwords and privilege management problems.

• Cloud threat monitoring (optional): once Entra ID is connected, ITP ingests your cloud and hybrid accounts, Entra ID audit logs, sign-in logs and Azure activity logs. It correlates SSO activity with your on-premises accounts and detects logins from suspicious IP addresses and abnormal access attempts.

Prerequisites

• A Microsoft Entra ID P1 or P2 licence. Microsoft Entra ID Free is not supported.

• An Azure subscription in the tenant. CrowdStrike deploys its log ingestion resources there.

• A person with the Global Administrator or Privileged Role Administrator role in Entra ID, to grant admin consent.

• A person with the Owner and Azure Deployment Stack Owner Azure roles at the Tenant Root Group level, to deploy the resources.

• A Falcon console account with the permissions to set up the connector. Stoïk creates it for you in step 1.

The Global Administrator role in Entra ID does not grant the Azure roles above. They must be assigned explicitly at the Tenant Root Group level, otherwise the deployment fails.

Integration

You run the whole setup yourself from your Falcon console. Stoïk gives you the access you need and checks the result. No secret is exchanged with Stoïk: the CrowdStrike API credentials needed for the deployment are generated by you in the console and only used in your own Azure Cloud Shell.

Complete this process for each Entra ID tenant.

Step	Who
1. Get your Falcon console access	You and Stoïk
2. Check your Azure roles	You (Azure administrator)
3. Create the Azure registration in Falcon	You
4. Grant admin consent	You (Global Administrator or Privileged Role Administrator)
5. Deploy the resources from Azure Cloud Shell	You (Azure administrator)
6. Complete and confirm the registration	You, then Stoïk
7. Grant remediation access to Stoïk	You (Global Administrator)

Ideally, the same person runs steps 3 to 6 and holds both the Entra ID and Azure roles above. Otherwise, plan a short session with the people concerned: the wizard must stay open from step 3 to step 6.

1

Get your Falcon console access

1. Email [e-mail] with the name and email of the person who will run the setup.

2. Stoïk creates a Falcon user account for this person, with the permissions needed to configure the Entra ID connector.

3. The person receives an activation email from CrowdStrike. They set their password and MFA, then sign in to the Falcon console.

2

Check your Azure roles

The person running the deployment opens Azure Cloud Shell in Bash mode and runs:

az role assignment list \
  --assignee $(az ad signed-in-user show --query id -o tsv) \
  --scope "/providers/Microsoft.Management/managementGroups/$(az account show --query tenantId -o tsv)" \
  --include-groups \
  --query "[?roleDefinitionName=='Owner' || roleDefinitionName=='Azure Deployment Stack Owner'].{Role:roleDefinitionName, Scope:scope}" \
  -o table

The output must list both Owner and Azure Deployment Stack Owner. If either role is missing, have it assigned at the Tenant Root Group level before you continue.

If you can't see or manage the Tenant Root Group, a Global Administrator must first enable Access management for Azure resources in Entra ID > Properties. This gives them the right to assign the roles above. You can turn it off again afterwards.

3

Create the Azure registration in Falcon

Before you start, copy from your Microsoft consoles:

• the Tenant ID: Microsoft Entra admin center > Entra ID > Overview

• the Subscription ID where CrowdStrike resources will be deployed: Azure portal > Subscriptions

Then, in the Falcon console:

1. Open the wizard:

   • If you have a legacy Entra ID connector, go to Identity protection > Settings > Configurations > Connectors and click Upgrade Now on it. The wizard opens with your tenant pre-filled.

   • Otherwise, go to Connectors > Cloud connectors > Cloud connections, open the Azure tab and click Add new registration. If prompted, select New deployment methods, then Next.

2. Registration parameters: enter a registration name, your Microsoft Entra tenant ID, select Bicep and enter the Subscription ID. Click Continue with standard setup.

3. Features: select Real-time visibility and detection, then Next.

4. Advanced settings: leave I want to customize Entra ID permissions unchecked. Change the region for log ingestion resources only if needed. Click Next.

5. API credentials: click Generate API client. Copy the Client ID and Client secret and keep them at hand for step 5. The secret is shown only once. Click Done, then Next.

Keep the client secret to yourself. Never send it by email, chat or ticket, including to Stoïk. You only need it in Azure Cloud Shell during step 5.

4

Grant admin consent

This step must be performed by a Global Administrator or Privileged Role Administrator. Without admin consent, Falcon cannot read Entra ID data and Identity Protection will not work.

1. On the Deploy configuration page of the wizard, click Grant admin consent and sign in with your Microsoft administrator account.

2. Check that the tenant ID in the URL matches your tenant.

3. Review the requested permissions and click Accept.

4. Back in the wizard, click Verify.

The application created by CrowdStrike only has read-only permissions on your directory.

5

Deploy the resources from Azure Cloud Shell

1. On the Deploy configuration page, open the Bash tab and click Download ZIP to get crowdstrike-fcs-azure-bicep-generated.zip.

2. In Azure Cloud Shell (Bash), upload the ZIP file.

3. Unzip it:

   unzip crowdstrike-fcs-azure-bicep-generated.zip

4. Check that the parameters file is present:

   ls parameters.bicepparam

   If the file isn't listed, check that you uploaded and unzipped the right file.

5. Copy the commands shown on the Bash tab and run them in order:

   • az login -t '<tenant ID>'

   • export FALCON_CLIENT_SECRET=<client secret from step 3>

   • az stack mg create ..., which deploys the Bicep template

6. Wait until the last command finishes. The terminal looks inactive while the deployment runs and only shows errors. This is normal.

6

Complete and confirm the registration

1. In the wizard, click Validate and complete.

2. On the Azure tab of Cloud connections, the registration first shows Pending, then Active. Allow about 2 hours for data to appear.

3. The registration is complete when both Assets and Real-time visibility and detection show Active.

4. Email [e-mail] with your tenant ID. Stoïk checks the registration and activates monitoring on its side.

Once the registration is active, Stoïk removes the configuration permissions from your Falcon account.

7

Grant remediation access to Stoïk

If an account is compromised outside business hours, your team may be unavailable. Granting this access lets Stoïk disable affected accounts once a compromise is confirmed.

1. Sign in as a Global Administrator and open the admin consent link.

2. Review the requested permissions and click Accept.

3. You land on a blank page. You can close it.

The application can only enable or disable existing accounts. It cannot create accounts or change other attributes. Each action requires MFA, is logged and is timestamped. Stoïk can provide the full audit log on request.

Migrating from the legacy connector

If you set up the previous Entra ID connector (application stoik-connector-itp with a client secret), it must be migrated:

1. Request your Falcon console access (step 1).

2. Complete steps 2 to 6. In step 3, start from Upgrade Now on the legacy connector.

3. Once the new registration is active, the legacy connector shows Ready to Decommission. Delete it in Identity protection > Settings > Configurations > Connectors, or ask Stoïk to do it.

4. You can then delete the old stoik-connector-itp application, its client secret and the Identity Protection RBAC Reader custom role from your tenant. They are no longer used.

Self-managed Falcon console

If you manage your own Falcon console, skip step 1 and use an account with the permissions to manage cloud registrations and API clients. Follow steps 2 to 7.