Microsoft Sentinel Data Connectors API

The Data Connectors API from Microsoft Sentinel — 1 operation(s) for data connectors.

Documentation GitHub OpenAPI

Operations 4

GET /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors Data connectors list #

PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId} Data connectors create or update #

DELETE /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId} Data connectors delete #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/microsoft-sentinel:microsoft-sentinel-data-connectors-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Microsoft Sentinel Data Connectors API
  version: '2025-09-01'
  x-typespec-generated:
  - emitter: '@azure-tools/typespec-autorest'
  description: 'Operations tagged Data Connectors across 2 of this provider''s published API definitions: microsoft-sentinel-securityinsights-2025-09-01.json, microsoft-sentinel-securityinsights-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://management.azure.com
security:
- azure_auth:
  - user_impersonation
tags:
- name: Data Connectors
paths:
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors
  : get:
      operationId: DataConnectors_List
      tags:
      - Data Connectors
      description: Gets all data connectors.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataConnectorList'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get all data connectors.:
          $ref: ./examples/dataConnectors/GetDataConnectors.json
      x-ms-pageable:
        nextLinkName: nextLink
      summary: Data connectors list
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
  ? /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}/providers/Microsoft.SecurityInsights/dataConnectors/{dataConnectorId}
  : get:
      operationId: DataConnectors_Get
      tags:
      - Data Connectors
      description: Gets a data connector.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: dataConnectorId
        in: path
        description: Connector ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Azure operation completed successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataConnector'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Get a ASC data connector.:
          $ref: ./examples/dataConnectors/GetAzureSecurityCenterById.json
        Get a MCAS data connector.:
          $ref: ./examples/dataConnectors/GetMicrosoftCloudAppSecurityById.json
        Get a MDATP data connector:
          $ref: ./examples/dataConnectors/GetMicrosoftDefenderAdvancedThreatProtectionById.json
        Get a MicrosoftThreatIntelligence data connector:
          $ref: ./examples/dataConnectors/GetMicrosoftThreatIntelligenceById.json
        Get a PremiumMicrosoftDefenderForThreatIntelligence data connector:
          $ref: ./examples/dataConnectors/GetPremiumMicrosoftDefenderForThreatIntelligenceById.json
        Get a RestApiPoller data connector:
          $ref: ./examples/dataConnectors/GetRestApiPollerById.json
        Get a TI data connector.:
          $ref: ./examples/dataConnectors/GetThreatIntelligenceById.json
        Get an AAD data connector.:
          $ref: ./examples/dataConnectors/GetAzureActiveDirectoryById.json
        Get an AATP data connector.:
          $ref: ./examples/dataConnectors/GetAzureAdvancedThreatProtectionById.json
        Get an AwsCloudTrail data connector.:
          $ref: ./examples/dataConnectors/GetAmazonWebServicesCloudTrailById.json
        Get an Office365 data connector.:
          $ref: ./examples/dataConnectors/GetOfficeDataConnetorById.json
      summary: Data connectors get
      x-summary-source: derived
    put:
      operationId: DataConnectors_CreateOrUpdate
      tags:
      - Data Connectors
      description: Creates or updates the data connector.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: dataConnectorId
        in: path
        description: Connector ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource 'DataConnector' update operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataConnector'
        '201':
          description: Resource 'DataConnector' create operation succeeded
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataConnector'
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Creates or updates a MicrosoftThreatIntelligence data connector.:
          $ref: ./examples/dataConnectors/CreateMicrosoftThreatIntelligenceDataConnector.json
        Creates or updates a PremiumMicrosoftDefenderForThreatIntelligence data connector.:
          $ref: ./examples/dataConnectors/CreatePremiumMicrosoftDefenderForThreatIntelligenceDataConnector.json
        Creates or updates an Office365 data connector.:
          $ref: ./examples/dataConnectors/CreateOfficeDataConnetor.json
        Creates or updates an Threat Intelligence Platform data connector.:
          $ref: ./examples/dataConnectors/CreateThreatIntelligenceDataConnector.json
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/DataConnector'
        description: The data connector
        required: true
      summary: Data connectors create or update
      x-summary-source: derived
    delete:
      operationId: DataConnectors_Delete
      tags:
      - Data Connectors
      description: Delete the data connector.
      parameters:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ApiVersionParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/SubscriptionIdParameter
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/parameters/ResourceGroupNameParameter
      - name: workspaceName
        in: path
        description: The name of the monitor workspace.
        required: true
        schema:
          type: string
          maxLength: 90
          minLength: 1
          pattern: ^[A-Za-z0-9][A-Za-z0-9-]+[A-Za-z0-9]$
      - name: dataConnectorId
        in: path
        description: Connector ID
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Resource deleted successfully.
        '204':
          description: Resource does not exist.
        default:
          description: An unexpected error response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CloudError'
      x-ms-examples:
        Delete an MicrosoftThreatIntelligence data connector:
          $ref: ./examples/dataConnectors/DeleteMicrosoftThreatIntelligenceDataConnector.json
        Delete an Office365 data connector.:
          $ref: ./examples/dataConnectors/DeleteOfficeDataConnetor.json
        Deletes a PremiumMicrosoftDefenderForThreatIntelligence data connector.:
          $ref: ./examples/dataConnectors/DeletePremiumMicrosoftDefenderForThreatIntelligenceDataConnector.json
      summary: Data connectors delete
      x-summary-source: derived
    servers:
    - url: https://management.azure.com
components:
  schemas:
    DataConnectorKind:
      type: string
      description: The kind of the data connector
      enum:
      - AzureActiveDirectory
      - AzureSecurityCenter
      - MicrosoftCloudAppSecurity
      - ThreatIntelligence
      - Office365
      - AmazonWebServicesCloudTrail
      - AzureAdvancedThreatProtection
      - MicrosoftDefenderAdvancedThreatProtection
      - MicrosoftThreatIntelligence
      - PremiumMicrosoftDefenderForThreatIntelligence
      - RestApiPoller
      x-ms-enum:
        name: DataConnectorKind
        modelAsString: true
        values:
        - name: AzureActiveDirectory
          value: AzureActiveDirectory
          description: AzureActiveDirectory
        - name: AzureSecurityCenter
          value: AzureSecurityCenter
          description: AzureSecurityCenter
        - name: MicrosoftCloudAppSecurity
          value: MicrosoftCloudAppSecurity
          description: MicrosoftCloudAppSecurity
        - name: ThreatIntelligence
          value: ThreatIntelligence
          description: ThreatIntelligence
        - name: Office365
          value: Office365
          description: Office365
        - name: AmazonWebServicesCloudTrail
          value: AmazonWebServicesCloudTrail
          description: AmazonWebServicesCloudTrail
        - name: AzureAdvancedThreatProtection
          value: AzureAdvancedThreatProtection
          description: AzureAdvancedThreatProtection
        - name: MicrosoftDefenderAdvancedThreatProtection
          value: MicrosoftDefenderAdvancedThreatProtection
          description: MicrosoftDefenderAdvancedThreatProtection
        - name: MicrosoftThreatIntelligence
          value: MicrosoftThreatIntelligence
          description: MicrosoftThreatIntelligence
        - name: PremiumMicrosoftDefenderForThreatIntelligence
          value: PremiumMicrosoftDefenderForThreatIntelligence
          description: PremiumMicrosoftDefenderForThreatIntelligence
        - name: RestApiPoller
          value: RestApiPoller
          description: RestApiPoller
    CloudErrorBody:
      type: object
      description: Error details.
      properties:
        code:
          type: string
          description: An identifier for the error. Codes are invariant and are intended to be consumed programmatically.
          readOnly: true
        message:
          type: string
          description: A message describing the error, intended to be suitable for display in a user interface.
          readOnly: true
    DataConnector:
      type: object
      description: Data connector
      properties:
        kind:
          $ref: '#/components/schemas/DataConnectorKind'
          description: Metadata used by portal/tooling/etc to render different UX experiences for resources of the same type; e.g. ApiApps are a kind of Microsoft.Web/sites type.  If supported, the resource provider must validate and persist this value.
        etag:
          type: string
          description: Etag of the azure resource
      discriminator:
        propertyName: kind
      required:
      - kind
      allOf:
      - $ref: ../../../../../../common-types/resource-management/v5/types.json#/definitions/ProxyResource
    DataConnectorList:
      type: object
      description: List all the data connectors.
      properties:
        value:
          type: array
          description: The DataConnector items on this page
          items:
            $ref: '#/components/schemas/DataConnector'
        nextLink:
          type: string
          format: uri
          description: The link to the next page of items
          readOnly: true
      required:
      - value
    CloudError:
      type: object
      description: Error response structure.
      properties:
        error:
          $ref: '#/components/schemas/CloudErrorBody'
          description: Error data
  securitySchemes:
    azure_auth:
      type: oauth2
      flows:
        implicit:
          scopes:
            user_impersonation: impersonate your user account
          authorizationUrl: https://login.microsoftonline.com/common/oauth2/authorize
      description: Azure Active Directory OAuth2 Flow.
x-refined-from:
- microsoft-sentinel-securityinsights-2025-09-01.json
- microsoft-sentinel-securityinsights-openapi.yml