Lab: Sentinel Data Federation and Custom Graphs

Guide for federating synthetic security context into Sentinel and modeling hidden privilege paths with reusable KQL, GQL, and sample tables.

Overview

This repository is a preview-feature guide with two synthetic CSV fixtures and reusable KQL/GQL. It explains how to prepare supported external tables, configure ADLS Gen2 federation, validate the resulting table names, and model a custom graph. It does not ship a tenant-specific connector, notebook authentication state, materialized graph, or workbook deployment.

Guide Status

Guide assets reviewed July 10, 2026; live steps not re-run. The sample rows parse and join consistently, query names match the documented federationlab suffix, and the repository steps were reconciled with the published article and current Microsoft guidance. This review did not create a connector, Key Vault, Sentinel tenant, Spark session, scheduled graph job, or custom graph; prior article screenshots are not a fresh tenant validation.

Safety and Limits

  • Use only synthetic or sanitized identity and entitlement data. The fixtures contain placeholder subscription, principal, and resource IDs.
  • Federation currently supports publicly reachable ADLS Gen2, Azure Databricks, or Microsoft Fabric sources; private endpoints are not supported. For ADLS, use Delta/Parquet tables and a same-tenant, read-only service principal whose short-lived secret is stored in Key Vault.
  • The Sentinel msg-resources-* platform identity needs Key Vault Secrets User, and the operator needs Sentinel Data (manage) permission over System tables plus the graph/notebook permissions required by the tenant.
  • Replace _federationlab in the queries if your connector instance uses another name, then refresh and inspect the federated schemas before trusting results.
  • Interactive notebook graphs are ephemeral. Materialize a shared graph through a scheduled graph job and remove both the job and graph during cleanup.
  • Federation, data-lake queries, Advanced Insights, graph operations, storage, Key Vault, and Spark compute can all affect cost. This four-row guide is not a complete effective-RBAC model.

Start Here

  1. Read the companion article for the architecture and evidence boundaries.
  2. Open the canonical GitHub repository.
  3. Follow the README through fixture review, table preparation, federation, graph creation, validation, and cleanup.

Use synthetic or sanitized identity and resource data when sharing lab results.