Accounts and account settings

These pages are available to users with account-management permissions.

Manage accounts

The Manage Accounts page lists manageable accounts and parent relationships. It also shows each account’s configured log sources, time-zone abbreviation and UTC offset, user count, and a seven-day alert-activity sparkline. Accounts are grouped with parents before their descendants by default. Use Search accounts… to find an account, or sort by grouped name, seven-day alert count, or user count. Use Create account to add an account when your organization’s workflow allows it. Enter an account name, an email domain such as company.com, and an optional parent account. New accounts use UTC by default, and users with a matching email domain can be added automatically when they first sign in. Account names are normalized for URL-compatible use: letters and numbers are retained, separators become hyphens, and the name is limited to 80 characters.

Account settings

From an account’s settings you can review or manage the following controls:

• Parent account — place the account under another manageable account. An account cannot be its own parent or a descendant of itself.
• DEVO identifier — set the account identifier used to match alerts from Devo, the log-ingestion source SIEM+ syncs from for this account, in the form name or name@name.
• Microsoft Sentinel tenant ID — enter the target Sentinel tenant’s GUID to make the three Sentinel agents available for this account. Leave it empty when Sentinel is not used; an empty value hides the Sentinel agents and prevents collection.
• Microsoft Sentinel application ID — enter the Microsoft Entra Application (client) ID as a valid GUID.
• Microsoft Sentinel client secret — enter the client secret for the Entra app registration. The secret is stored per account and is never displayed after saving; leave the field blank to keep an existing secret.
• Microsoft Sentinel workspace ID — optionally enter the target workspace GUID for Advanced Hunting. Leave it empty to use the Sentinel tenant’s primary/default workspace. This setting is used by the profile and heartbeat agents; the alert agent uses Microsoft Graph security endpoints.
• LogEase URL and API key — enter both values to make the LogEase alert job available for the account. A saved key is never displayed; leave its field blank to keep it or clear it with the provided control.
• Email domain — set the domain used for account membership matching. This field is required.
• Timezone — choose the account time zone used for account dates, alert statistics, schedules, and agent history.
• Whitelist / blacklist — add Whitelist or Blacklist entries for an IP address, URL, hostname, or username.
• Days to sync — set the alert and heartbeat lookback period from 1 to 3,650 days, then reset the sync period.
• Alert retention days — keep alerts for 1 to 40 days. Older alerts are removed by housekeeping.
• Users — add a user, change their role, enable report notifications, choose their notification language, or remove their membership.

The Account Settings page is organized into General, Integrations, Detection Tuning, Security, Ingestion, Users, and Alert Statistics tabs. Sentinel and LogEase connection settings are under Integrations.

Microsoft Sentinel source

The Microsoft Sentinel tenant ID is the account-level source marker for the mssentinel-alert-download, mssentinel-user-behavior-profile-download, and mssentinel-heartbeat agents. Enter a valid tenant GUID in Account Settings > Integrations to make all three agents available for that account. Clearing the value hides them and stops them from running for the account.

The tenant ID alone does not authorize collection. In Account Settings > Integrations, configure the target tenant’s Application (client) ID, Client secret, and optional workspace ID, then select Save. The client secret is stored per account and is not returned by the API. In Agent Jobs, save only the Sentinel job’s operational settings; those settings are stored in the agent definition context and are shared by accounts using that definition. See Sentinel alert data collection for Graph permissions, collection purpose, incremental sync behavior, and stored data.

The LogEase section of Integrations requires both a valid HTTP/HTTPS URL and an API key. The key is stored per account and never shown after saving. Clearing either required value makes the LogEase alert job unavailable for that account.

Alert statistics and resync

Use Alert Statistics to inspect downloaded alerts by local account date. Move between weeks with the arrow buttons or choose a date in the date picker. If a source day needs correction, choose a past date and select Reset. The next alert download refreshes that day’s source alerts. Future dates cannot be reset. Resetting a date is a corrective action—confirm the date before using it.

In the same settings area, use Regenerate heartbeat for a date when historical heartbeat data needs to be rebuilt. Choose a local past date and select Regenerate heartbeat. The next heartbeat download refreshes heartbeat data for that local day only; the button shows when the request is being processed.

Step-by-step: create and configure an account

1. Open Manage Accounts. To create an account, enter the account name and required email domain, optionally choose a parent account, and select Create.
2. Select the account name to open Account Settings. Confirm the account name, email domain, creation time, and current parent.
3. In Parent account, choose None or a parent account, then select Update parent. Do not create a cycle in the account hierarchy.
4. In General, confirm the email domain and account time zone, then select Save.
5. In Integrations, set the DEVO identifier and, when Sentinel is used, the tenant ID, application ID, client secret, and optional workspace ID. Select Save after changing each integration.
6. In Detection Tuning, select Add entry, choose Whitelist or Blacklist, choose the target type, enter its value, and select Save whitelist / blacklist. Remove obsolete rows before saving.
7. In Ingestion, enter the required lookback in Days to sync (1–3,650), review the current alert and heartbeat periods, and select Reset sync period. This resets both periods. Set Alert retention days to 1–40 days and save the account settings.
8. In Users, enter the email address of a user who has signed in at least once, choose a role, and select Add. Use the role control to change a membership later.
9. For a user who should receive account report notifications, check Enabled in the Notifications column, choose English, Taiwan Chinese, or Japanese, and wait for the update confirmation. Select Remove only when the membership should be deleted.
10. Return to Manage Accounts and verify the account’s parent, domain, time zone, and user count in the table.

Step-by-step: correct an alert date

1. Open the account’s Account Settings page and scroll to Alert Statistics.
2. Use the week arrows or date picker to find the account-local date that needs correction.
3. Review the downloaded count and latest alert time for that date.
4. Select Reset on the past date and confirm that it is the intended source day.
5. Wait for the next alert download. The selected date is queued as the alert sync window and will be refreshed then.

Step-by-step: regenerate heartbeat data for a date

1. Open the account’s Account Settings page and go to the heartbeat or Data Sync settings.
2. In Regenerate heartbeat for a date, choose the local date that needs repair.
3. Select Regenerate heartbeat and wait for the confirmation that the request was queued.
4. Wait for the next heartbeat download, then return to the account settings or Compliance page to verify the refreshed day.

This action refreshes only the selected local day. Confirm the account and date before submitting the request.

These actions require account-management permissions. Changes are saved per account; verify the selected account before editing settings or resetting alert data.

Account hierarchy and notification recipients

The Parent account control changes the account hierarchy. Choose None to make an account a root account, or select another manageable account to make it a child. SIEM+ prevents self-parenting and descendant cycles. A user can receive account report notifications only after they are a member of the account and the notification switch is enabled.

Account administrators and owners can also open Access history from the account settings page to review access by users, integrations, and support.