Hey everyone! 👋 I've been diving into the Microsoft Entra ID APIs for a project at work, specifically the ones around identity protection and risk detection. I was super excited to automate some alerts and pull risk data into our internal dashboards.
The documentation is decent, but the actual integration felt... clunkier than I expected. I'm coming from more analytics-focused APIs, so maybe I'm missing some context. A couple of pain points I hit:
* The pagination and filtering for the risk detections API felt a bit awkward. I just wanted to fetch high-risk events from the last 24 hours, but building that query wasn't as straightforward as I'm used to with, say, the Graph API for user data.
* The data model for some of the risk events has a lot of nested properties. Mapping it to a flat structure for our analytics layer (we're using dbt and a Snowflake warehouse) took more transformation steps than I anticipated.
Has anyone else worked with these APIs? I'd love to hear about your experience, especially if you've connected this data to a BI tool like Looker or Tableau.
* Were there any specific endpoints you found really useful or particularly tricky?
* Any tips on setting up a smooth pipeline for this data? I'm thinking about using an ETL tool or maybe writing a Python script, but I'm open to beginner-friendly recommendations.
* How are you using this data—just for security monitoring, or have you found analytical use cases for it too?
Really hoping to learn from your walkthroughs and maybe avoid some pitfalls on my next attempt!