Data Protection Issues

How to Stream Microsoft Defender for Office 365 Alerts to an External SIEM

Rana Garcia Oct 21, 2026 868 views

Question details

The user is attempting to stream Microsoft Defender for Office 365 alerts to an external SIEM but cannot find the required SecurityEvents.Read.All permission during Azure application configuration.

How to Stream Microsoft Defender for Office 365 Alerts to an External SIEM

Product: Microsoft Defender for Office 365
Device & OS: not provided
Scenario: Configuring an Azure application to integrate Microsoft Defender for Office 365 alerts with an external SIEM system.
Observed behavior: The SecurityEvents.Read.All API permission is missing or unavailable in the Azure portal, blocking the alert integration setup.

Before you start

Ensure you have global administrator or security administrator access to your Microsoft 365 and Azure portals before verifying licensing and API permissions.

Solution 1Recommended

Verify Licensing and Contact Support for API Permissions

Check if your organization has the required licenses to enable advanced API capabilities, and reach out to Microsoft Azure support if the permission remains hidden.

Advanced alert capabilities and API access for SIEM integration heavily depend on your Microsoft 365 subscription tier. If the correct license is not applied, specific permissions like SecurityEvents.Read.All will not be visible in the Azure portal.

Verify Microsoft 365 Licensing

Log in to the Microsoft 365 admin center and check your active subscriptions. Ensure your organization has Microsoft Defender for Office 365 Plan 2, which is typically included in Microsoft 365 E5 or Microsoft 365 E5 Security.

Check Azure App Permissions

Navigate to the Microsoft Azure portal, go to Microsoft Entra ID (formerly Azure AD), and select 'App registrations'. Locate your application, click 'API permissions', and attempt to add 'SecurityEvents.Read.All' again.

Contact Microsoft Azure Support

If the correct licensing is active but the permission is still missing, open a support ticket with the Azure team through the portal or post on Microsoft Q&A for backend assistance with configuring your application.

Verify Licensing and Contact Support for API Permissions

License Propagation Time: If you recently upgraded your subscription to Microsoft 365 E5, it may take up to 24 hours for the new API permissions to become available in the Azure portal.

Free Microsoft Office alternative

Looking for a secure, lightweight alternative to Microsoft Office?

While enterprise security configurations like SIEM integrations require specific Microsoft 365 licenses and complex setup, many teams simply need a reliable and secure office suite for daily document tasks. WPS Office provides a lightweight, highly compatible, and free alternative with powerful features for creating and editing documents without complicated licensing tiers.

1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
2. Install the Application: Run the downloaded installer and follow the simple on-screen instructions to set up your new workspace.
3. Open and Secure Your Documents: Instantly open your existing Microsoft Office documents, edit them seamlessly, and apply local file encryption if needed.

Robust local document security features to keep your sensitive data protected without complex cloud configurations.Fully compatible with Microsoft Office formats, ensuring seamless access to DOCX, XLSX, and PPTX files.Lightweight architecture ensures fast startup and smooth operation on any device.Free to download and use with a highly familiar and intuitive user interface.

microsoft office alternative - wps office

Frequently Asked Questions

Why is the SecurityEvents.Read.All permission missing in Azure?

This permission is typically hidden or unavailable if your tenant lacks the required Microsoft Defender for Office 365 Plan 2 license. In some cases, it may also require manual backend enablement by Microsoft Support.

Which Microsoft 365 licenses include Defender for Office 365 Plan 2?

Plan 2 is generally included in premium enterprise subscriptions, most notably Microsoft 365 E5 and Microsoft 365 E5 Security.

Can I stream Defender alerts to a third-party SIEM without an E5 license?

Advanced alert streaming capabilities and API access for external SIEM integration usually require specific security add-ons or an E5 subscription. We recommend checking Microsoft's official licensing documentation for your specific SIEM requirements.

Microsoft Office Security Issues