---
title: "Migration guide for Microsoft Graph collector"
canonical: "https://docs.devo.com/space/latest/1219428429/Migration%20guide%20for%20Microsoft%20Graph%20collector"
format: markdown
---
> Macro (toc)

## 2.X to 3.X migration guide

In 3.0, alerts_v2 are categorized automatically into different tables.  To turn that off, use:

```
        "alerts_v2": {
          "override_tag": "cloud.msgraph.security.alerts_v2"
        }
```

## 1.X to 2.X migration guide

Version 2.0.0 introduced several changes to the collector's configuration. When upgrading the collector, users must make changes to their configuration file to ensure that the collector continues to work as expected.

> ⚠️ **Important**
> ⚠️ 
> ⚠️ Note that `tag_version` behaviour has been replaced by `override_tag`

In versions 1.X of the collector, some services had a config parameter `tag_version` with values `v1`or `v2`. The effect of this parameter is that the destination table for these services will be different. These are the destination tables according to the `tag_version` value:

| **v1** | **v2 (default)** |
| --- | --- |
| `cloud.msgraph.security.score` | `cloud.office365.security.score` |
| `cloud.msgraph.security.scorecontrol` | `cloud.office365.security.scorecontrol` |

In the new collector 2.0.0, the old config parameter `tag_version` has been removed. The same effect as `v1`can be made using `override_tag`, with these values:

| Service | `override_tag` (to obtain the behaviour equivalent to `tag_version: v1`) |
| --- | --- |
| `secure_scores` | `cloud.msgraph.security.scores.2` |
| `secure_score_control_profiles` | `cloud.msgraph.security.scorecontrol.2` |

For instance, if we have this in the old configuration:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> ```
> "secure_scores": {
>     "tag_version": "v1"
>   },
>   "secure_score_control_profile": {
>     "tag_version": "v1"
>   }
> ```
> 
> > Macro (rw-tab)
> 
> ```
> secure_scores:
>       tag_version: v1
> secure_score_control_profile:
>       tag_version: v1
> ```

You should change it to:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> ```
> "secure_scores": {
>     "override_tag": "cloud.msgraph.security.scores.2"
>   },
>   "secure_score_control_profile": {
>     "override_tag": "cloud.msgraph.security.scorecontrol.2"
>   }
> ```
> 
> > Macro (rw-tab)
> 
> ```
> secure_scores:
>         override_tag: cloud.msgraph.security.scores.2
>       secure_score_control_profile:
>         override_tag: cloud.msgraph.security.scorecontrol.2
> ```

> ⚠️ **Important**
> ⚠️ 
> ⚠️ Note that security alerts are sent to different tables according to their categories.

In old versions of this collector, all alerts were sent to the table `cloud.msgraph.security.alerts` 

However, as there are alerts of several types, in version 2.0.0 alerts are categorized according to their `vendorInformation-provider` field (their vendor) and sent to different tables:

| **Vendor** | **Old table** | **New table** |
| --- | --- | --- |
| IPC | `cloud.msgraph.security.alerts` | `cloud.azure.ad.alerts` |
| MCAS | `cloud.office365.cloud_apps.alerts` |
| Microsoft Defender ATP | `cloud.office365.endpoint.alerts` |
| Microsoft 365 Defender | `cloud.office365.endpoint.alerts` |
| Office 365 Security and Compliance | `cloud.office365.security.alerts` |
| Azure Sentinel | `cloud.azure.sentinel.alerts` |
| ASC | `cloud.office365.identity.alerts` |
| Azure Advanced Threat Protection | `cloud.azure.securitycenter.alerts` |
| Others | `cloud.msgraph.security.alerts` |

It is possible to avoid this feature and send all alerts to the same table by editing the config file and changing the tag:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> ```
> "alerts": {
>     "override_tag": "cloud.msgraph.security.alerts.2"
>   }
> ```
> 
> > Macro (rw-tab)
> 
> ```
> alerts:
>         override_tag: cloud.msgraph.security.alerts.2
> ```

### Config file comparison

Below you will find a sample 1.7.1 configuration file and a sample 2.0.0 configuration file.

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> ```
> {
>   "inputs": {
>     "microsoft_graph": {
>       "id": "<short_unique_id>",
>       "enabled": true,
>       "credentials": {
>         "tenant_id": "<tenant_id_value>",
>         "client_id": "<client_id_value>",
>         "client_secret": "<client_secret_value>"
>       },
>       "services": {
>         "audit": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "provisioning": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "signIn": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "signIn_nonInteractive": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "signIn_servicePrincipal": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "signIn_managedIdentity": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "secure_score_control_profile": {
>           "tag_version": "v2",
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "alerts": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "pull_sliding_window_timespan_period": "<pull_sliding_window_timespan_period_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "secure_scores": {
>           "tag_version": "v2",
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "pull_sliding_window_timespan_period": "<pull_sliding_window_timespan_period_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         },
>         "alerts_v2": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "reset_persistence_auth": "<reset_persistence_auth_value>",
>           "start_time": "<start_time_value>",
>           "override_time_delta_in_days": "<override_time_delta_in_days_value>",
>           "ms_365_environment": "<ms_365_environment_value>",
>           "custom_endpoints": {
>             "override_base_url_main": "<override_base_url_main_value>",
>             "override_base_url_vendor": "<override_base_url_vendor_value>",
>             "override_base_url_vendor_with_sub_provider": "<override_base_url_vendor_with_sub_provider_value>",
>             "override_login_url": "<override_login_url_value>",
>             "override_scope": "<override_scope_value>"
>           }
>         }
>       }
>     }
>   }
> }
> ```
> 
> > Macro (rw-tab)
> 
> ```
> {
>   "inputs": {
>     "microsoft_graph_audit": {
>       "id": "<short_unique_id>",
>       "enabled": true,
>       "credentials": {
>         "tenant_id": "<tenant_id_value>",
>         "client_id": "<client_id_value>",
>         "client_secret": "<client_secret_value>"
>       },
>       "environment": "<environment_value>",
>       "override_top_level_domain": "<override_top_level_domain_value>",
>       "override_base_url": "<override_base_url_value>",
>       "override_login_url": "<override_login_url_value>",
>       "override_scope_value": "<override_scope_value_value>",
>       "services": {
>         "directory_audits": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         },
>         "provisioning_audits": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         },
>         "signIns": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         },
>         "signIns_v2": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         }
>       }
>     },
>     "microsoft_graph_security": {
>       "id": "<short_unique_id>",
>       "enabled": true,
>       "credentials": {
>         "tenant_id": "<tenant_id_value>",
>         "client_id": "<client_id_value>",
>         "client_secret": "<client_secret_value>"
>       },
>       "environment": "<environment_value>",
>       "override_top_level_domain": "<override_top_level_domain_value>",
>       "override_base_url": "<override_base_url_value>",
>       "override_login_url": "<override_login_url_value>",
>       "override_scope_value": "<override_scope_value_value>",
>       "services": {
>         "secure_score_control_profiles": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>"
>         },
>         "secure_scores": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         },
>         "alerts": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         },
>         "alerts_v2": {
>           "request_period_in_seconds": "<request_period_in_seconds_value>",
>           "start_time_in_utc": "<start_time_in_utc_value>",
>           "additional_filter": "<additional_filter_value>",
>           "override_tag": "<override_tag_value>",
>           "override_query_window_max_seconds": "<override_query_window_max_seconds_value>"
>         }
>       }
>     }
>   }
> }
> ```
> 
> > Macro (rw-tab)
> 
> ```
> inputs:
>   microsoft_graph:
>     id: <short_unique_id>
>     enabled: true
>     credentials:
>       tenant_id: <tenant_id_value>
>       client_id: <client_id_value>
>       client_secret: <client_secret_value>
>     services:
>       audit:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       provisioning:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       signIn:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       signIn_nonInteractive:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       signIn_servicePrincipal:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       signIn_managedIdentity:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       secure_score_control_profile:
>         tag_version: v2
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       alerts:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         pull_sliding_window_timespan_period: <pull_sliding_window_timespan_period_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       secure_scores:
>         tag_version: v2
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         pull_sliding_window_timespan_period: <pull_sliding_window_timespan_period_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
>       alerts_v2:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         reset_persistence_auth: <reset_persistence_auth_value>
>         start_time: <start_time_value>
>         override_time_delta_in_days: <override_time_delta_in_days_value>
>         ms_365_environment: <ms_365_environment_value>
>         custom_endpoints:
>           override_base_url_main: <override_base_url_main_value>
>           override_base_url_vendor: <override_base_url_vendor_value>
>           override_base_url_vendor_with_sub_provider: <override_base_url_vendor_with_sub_provider_value>
>           override_login_url: <override_login_url_value>
>           override_scope: <override_scope_value>
> ```
> 
> > Macro (rw-tab)
> 
> ```
> inputs:
>   microsoft_graph_audit:
>     id: <short_unique_id>
>     enabled: true
>     credentials:
>       tenant_id: <tenant_id_value>
>       client_id: <client_id_value>
>       client_secret: <client_secret_value>
>     environment: <environment_value>
>     override_top_level_domain: <override_top_level_domain_value>
>     override_base_url: <override_base_url_value>
>     override_login_url: <override_login_url_value>
>     override_scope_value: <override_scope_value_value>
>     services:
>       directory_audits:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
>       provisioning_audits:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
>       signIns:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
>       signIns_v2:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
>   microsoft_graph_security:
>     id: <short_unique_id>
>     enabled: true
>     credentials:
>       tenant_id: <tenant_id_value>
>       client_id: <client_id_value>
>       client_secret: <client_secret_value>
>     environment: <environment_value>
>     override_top_level_domain: <override_top_level_domain_value>
>     override_base_url: <override_base_url_value>
>     override_login_url: <override_login_url_value>
>     override_scope_value: <override_scope_value_value>
>     services:
>       secure_score_control_profiles:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>       secure_scores:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
>       alerts:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
>       alerts_v2:
>         request_period_in_seconds: <request_period_in_seconds_value>
>         start_time_in_utc: <start_time_in_utc_value>
>         additional_filter: <additional_filter_value>
>         override_tag: <override_tag_value>
>         override_query_window_max_seconds: <override_query_window_max_seconds_value>
> ```

### Config file changes

- The URL endpoints (`override_base_url_main`, `override_base_url_vendor`, `override_base_url_vendor_with_sub_provider` , `override_login_url`) have been moved from the individual services to the global configuration section.
- `override_base_url_main` has been renamed to `override_base_url`.
- `tag_version` has been removed.
- `pull_sliding_window_timespan_period` has been removed.
- `reset_persistence_auth` has been removed.
- `override_time_delta_in_days` has been removed.
- `ms_365_environment` has been replaced by `override_top_level_domain`. GCC High Gov should use `us` in the `override_top_level_domain`. Alternatively, users can use `override_base_url` to specify the GCC High Gov base URL.
- `additional_filter` has been added to all services. Users can use this field to specify additional filters that will be applied when querying the Microsoft Graph API.
- The collector can use new services from Graph (beta endpoint in Graph), that services, that use to be in a separate service for each type, have been consolidated into one service called `signIns_v2`. Users should remove all three services from their config and use only the `signIns_v2` service.
- `start_time` has been renamed to `start_time_in_utc`.

### Persistence changes

- The persistence object consists of the following fields: `persistence_version`, `last_event_time_in_utc`, `last_ids`, and `next_link`.
- The collector will automatically map old key names (e.g. `last_polled_timestamp` → `last_event_time_in_utc`) to the appropriate value.