Concelier MSRC Connector - Microsoft Entra Onboarding Brief

Last updated: 2026-04-22

This brief is for operators onboarding the Microsoft Security Response Center (MSRC) connector in a Stella Ops Concelier instance. It walks through the Microsoft Entra app registration, the secret/credential policy, the compatibility fallback configuration, CVRF artefact handling, and the outstanding items to confirm before production use.

For the shared credential-entry workflow across connectors, see Advisory source credential entry.

1. App registration requirements

Create or select a confidential client application that will use client credentials. Capture:

tenantId = Directory (tenant) ID
clientId = Application (client) ID
clientSecret = client secret value from Certificates & secrets

Primary operator path:

Web UI: Security Posture -> Configure Sources or Ops -> Operations -> Feeds & Airgap -> Configure Sources

CLI:

stella db connectors configure microsoft \
  --server https://concelier.example.internal \
  --set tenantId=... \
  --set clientId=... \
  --set clientSecret=...

Notes:

Microsoft recommends certificates over client secrets for production applications. The current Stella Ops MSRC operator entry path is client-secret based.
MSRC is not documented here as a separate paid product, but you do need a Microsoft Entra tenant plus permission to register the app and grant the required consent.

2. Secret and credential policy

Maintain two client secrets rotating every 90 days.
Prefer storing the active secret through the Stella Ops source configuration UI or CLI.
Offline Kit deployments that still mirror secrets out of band must mirror the secret payloads in their encrypted store.
Legacy host configuration remains a compatibility fallback only.

3. Compatibility fallback (`concelier.yaml`)

concelier:
  sources:
    microsoft:
      tenantId: "<azure-tenant-guid>"
      clientId: "<app-registration-client-id>"
      clientSecret: "<pull from secret store>"
      apiVersion: "2024-08-01"
      locale: "en-US"
      requestDelay: "00:00:00.250"
      failureBackoff: "00:05:00"
      cursorOverlapMinutes: 10
      downloadCvrf: false

The runtime source ID is microsoft, and the connector still binds the legacy vndr:msrc section for compatibility.

4. CVRF artefacts

The MSRC REST payload exposes cvrfUrl per advisory.
Current connector behavior records the link as advisory metadata and reference; it does not download the ZIP by default.
Mirror CVRF ZIPs when preparing Offline Kits if air-gapped deployments need them.

5. Outstanding items