feat(stream-microsoft-sentinel-intel): add native azure auth (#7063)

[Renizmy]

Proposed changes

• Add DefaultAzureCredentials() fallback

Related issues

• Closes: feat(stream-microsoft-sentinel-intel): Add native azure auth #7063

Checklist

• I consider the submitted work as finished
• I have signed my commits using GPG key.
• I tested the code for its functionality using different use cases
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality

[Copilot]

Pull request overview

This PR updates the Microsoft Sentinel Intel stream connector to support “native” Azure authentication by falling back to DefaultAzureCredential when explicit app-registration credentials aren’t provided, aligning the connector with Managed Identity / Workload Identity use cases from #7063.

Changes:

• Make tenant_id, client_id, and client_secret optional and validate they are provided consistently (all-or-none).
• Add runtime fallback to DefaultAzureCredential when app-registration credentials are not set.
• Update documentation and generated metadata to reflect the new authentication options.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
stream/microsoft-sentinel-intel/src/microsoft_sentinel_intel/settings.py	Makes Azure app-registration fields optional and adds a config-level consistency validator.
stream/microsoft-sentinel-intel/src/microsoft_sentinel_intel/client.py	Chooses between ClientSecretCredential and DefaultAzureCredential for ARM auth.
stream/microsoft-sentinel-intel/README.md	Documents the two auth modes and updates setup guidance/snippets.
stream/microsoft-sentinel-intel/docker-compose.yml	Adds guidance comments for optional auth env vars in the example compose file.
stream/microsoft-sentinel-intel/metadata/connector_config_schema.json	Updates schema defaults/required fields to reflect optional auth variables.
stream/microsoft-sentinel-intel/metadata/CONNECTOR_CONFIG_DOC.md	Updates generated config documentation to mark auth vars as optional with null default.

[ncarenton]

Catalog deployment tested locally:

[ncarenton]

Hi @Renizmy 👋 (cc @romain-filigran),one question about the native Azure auth added here.

Making TENANT_ID / CLIENT_ID / CLIENT_SECRET optional with a DefaultAzureCredential fallback also removes them from the required array of the schema. Since the catalog UI builds its form and validation from that schema, a catalog user can now deploy the connector without any Azure credentials and get no warning.

At runtime, a catalog-deployed (non-Azure-native) container then falls through to DefaultAzureCredential, which has no usable credential source. Token acquisition is lazy, so the connector starts fine and only fails on the first Azure API call. Repro without the vars:

ClientAuthenticationError: DefaultAzureCredential failed to retrieve a token
  EnvironmentCredential: Environment variables are not fully configured.
  WorkloadIdentityCredential: Missing 'tenant_id', 'client_id', 'token_file_path'.
  ManagedIdentityCredential: no response from the IMDS endpoint.
  AzureCliCredential: Azure CLI not found on path

Does this seem like a real problem to you? If so, what about an explicit AUTH_METHOD switch (app_registration default / default_credential), keeping the three fields required unless the user explicitly opts into managed identity?