# =============================================================================
# Microsoft Security Agent Toolkit - environment template
# =============================================================================
# Copy to `.env` and fill in. NEVER commit `.env` (already in .gitignore).
# Use a dedicated Entra app registration with the minimum scopes required.
# See docs/permissions-required.md for the exact scopes per server.
# =============================================================================

# ---- Entra app registration (used by all MCP servers) -----------------------
TENANT_ID=
CLIENT_ID=
CLIENT_SECRET=

# ---- Microsoft Sentinel / Log Analytics --------------------------------------
# Workspace the sentinel-mcp server will query.
SENTINEL_SUBSCRIPTION_ID=
SENTINEL_RESOURCE_GROUP=
SENTINEL_WORKSPACE_ID=
SENTINEL_WORKSPACE_NAME=

# ---- Microsoft Defender XDR --------------------------------------------------
# Defender XDR uses the same TENANT_ID / CLIENT_ID / CLIENT_SECRET above
# but requires SecurityIncident.Read.All / AdvancedHunting.Read.All Graph scopes.

# ---- Microsoft Graph (Entra) -------------------------------------------------
# graph-security-mcp uses TENANT_ID / CLIENT_ID / CLIENT_SECRET above.
# Required scopes: AuditLog.Read.All, IdentityRiskyUser.Read.All,
# SignIns.Read.All; add User.RevokeSessions.All only if you enable write actions.

# ---- Purview Audit -----------------------------------------------------------
# purview-audit-mcp uses TENANT_ID / CLIENT_ID / CLIENT_SECRET above.
# Required scope: AuditLog.Read.All (and an account with the Audit Reader role).

# ---- Optional: Security Copilot ----------------------------------------------
# Only needed for samples that integrate with Microsoft Security Copilot APIs.
SECURITY_COPILOT_API_ENDPOINT=