ThreatLens Operations

Clients

Client name	Tenant ID	App (client_id)	Workspace	Warehouse customer_id	Consent	LA Reader	Secret status	Refresh freshness	Next scheduled	Actions

Add client

Who is this client?

Client name Tenant ID The client's Microsoft Entra tenant GUID. Enterprise app client ID Access mode

How do we authenticate?

Paste the secret you just created in the client's app registration — it is written straight into Key Vault and never stored here. Everything after this step needs it.

New client secret value Paste it once, then click Save to Key Vault. Cleared from this field immediately after saving.

Client secret reference Set automatically by Save to Key Vault above. Advanced/manual path: create the secret in Key Vault yourself and type its name here instead. Client secret expiry

Consent granted LA Reader assigned

Where does their data come from?

Log Analytics feeds KQL metrics; the warehouse customer ID feeds SQL metrics. A client can use either or both.

Workspace customer ID The GUID labelled "Workspace ID" on the Log Analytics workspace's Overview page in the Azure portal. This is the one queries actually use. Workspace resource ID Optional. The full ARM resource ID (starts with /subscriptions/) — only used as the RBAC scope when you manually assign Log Analytics Reader. Not required for queries to work. MDE region Warehouse customer ID Optional. The GUID this client's rows carry in the SQL warehouse. Click Generate for a new client, or paste the existing ID. Leave blank if this client has no SQL metrics.

Centralized Defender groups

Selections are resolved once and reused by refresh, exposure metrics, previews, reports, and audit evidence.

Reads the device groups straight from the client's Defender tenant.

ETL scope

Servers

Workstations

Tick every group that belongs to each purpose — a group can appear in more than one.

Refresh parameters (JSON scalars only) Secret-, password-, credential-, key-, and token-like names are rejected.

When should it run?

Schedule override

Nightly refresh Local time IANA timezone Monthly refresh + report Day of month Local time

Is it ready to run?

Save the client first. Connection testing reads the stored record, so it runs against what was saved.

Assign template Slide set

Current Month Dashboard

Read-only charts from the latest stored report contract. Opening this page never reruns a data-source query.

Choose a client to load its current-month stored dashboard.

Query tester

Run a read-only ad-hoc query for one client without adding it to the metric catalog. SQL must include a customer_id = ? parameter; every placeholder is bound to the selected client.

Choose a client, source, period, and query to explore its rows.

Metric Preview

Run one catalog metric for a client without saving evidence or changing a report.

Choose a client and metric to preview its rows.

Metric Editor

Change the query behind one metric, or switch a metric off. Edit it for all clients and every client inherits it, including ones onboarded later; edit it for one client and only that client departs, over whatever the all-clients layer says. A client with no edit of its own keeps getting catalog fixes automatically. Try a change with Run this query before saving — it runs read-only and saves nothing.

Choose a client and metric to see its query.

Query

Why this client differs (optional)

Custom Metrics

Define a metric with no entry in the standard catalog and bind it to one of the four generic slots on the Custom Metrics slide — three single-number tiles and a table. A custom metric applies to all clients at once, the same as the Metric Editor's all-clients edits, since it is the same template slide in every deck. Deleting one removes it outright; there is no catalog copy underneath it to fall back to.

Id Label Source Slide slot

Query SQL parameters, in bind order (comma-separated)

Every custom metric returns exactly two columns, label and value — one row for a tile, one row per result for the table.

Note (optional) Uses {{period}} / :period Enabled

Report Preview

Render a read-only SVG preview from the selected period's stored report data. The downloaded PowerPoint remains the authoritative output.

Choose a client and period to render slide previews.

Generate reports

Run for Client Template Slide set

Refresh and generate collects fresh evidence from each client tenant and then renders, which takes minutes. Generate from stored data re-renders a month already collected, in seconds — use it to try a different template.

Results

Client	Status	Finished	Size	Report

Problems

Refresh one client

Refresh all clients

Worker

Global automation defaults

Run Summary

Tenant Readiness

Tenant	Client	Ready	Consent	Client secret	Workspace	LA Reader	Template	Pinned	Missing Checks

Runs

Workflow / run	Client	Period	Status	Stages	Mode	Refresh rows	Freshness	Source as of	Trigger	Finished	Actions

Run Detail

Select a run to view status, evidence, warnings, and errors.

Domain Status

Domain	Status	Source Period	Detail

Warnings

Errors

Evidence

Metric	Source	Endpoint / Query	Period

Contract Explorer

Template Registry

Token validation report will appear after upload.

Template ID	Scope	Tenant	Actions

Template Assignments

Tenant	Template	Version	Slide Set	Assigned UTC

Access Control

ThreatLens permissions are managed here. Microsoft Entra signs users in but does not grant application access.

Users

A user also appears here on their own, as pending, the first time they sign in. Add one ahead of that when you have their Entra object ID, and they can work the moment they authenticate.

User	Sign-in	Object ID	Status	Action

Role assignments

User	Role	Scope	Tenant	Action

Roles and permissions

Role	Type	Permissions	Action