# Microsoft Entra ID logs

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fazure%2Fmicrosoft-entra-id-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Fazure%2Fmicrosoft-entra-id-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Microsoft Entra ID (previously Azure Active Directory) records tenant activity in three log types, and they sit behind many of its built-in reports. Routing them to Coralogix puts identity activity next to the rest of your telemetry, where it can be correlated and alerted on.

| Log type                                                                                                                   | Contains                                                    |
| -------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- |
| [Audit logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs)               | Every task performed in your tenant                         |
| [Sign-in logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins)           | Sign-in attempts by users and client applications           |
| [Provisioning logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-provisioning-logs) | Users provisioned into your tenant by a third-party service |

Collection takes two moves: a diagnostic setting that streams the logs to an Event Hub, and the [Event Hub integration](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md) that forwards from there.

## What you need [​](#what-you-need- "Direct link to what-you-need-")

* A Microsoft Entra ID account with an active subscription. Exporting sign-in data additionally requires a P1 or P2 Entra ID license.
* An Event Hub namespace. If yours restricts public access, enable VNet support first. See the [optional configuration steps](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md).

## Export the logs to an Event Hub [​](#export-the-logs-to-an-event-hub- "Direct link to export-the-logs-to-an-event-hub-")

1

<!-- -->

.

Open diagnostic settings

Navigate to your Microsoft Entra ID resource, then select **Diagnostic settings** under **Monitoring**.

2

<!-- -->

.

Add a setting

Select **Add diagnostic setting** and give it a name.

3

<!-- -->

.

Pick the categories and destination

Select the categories you want. **AuditLogs** and **SignInLogs** at minimum, plus the sign-in variants and **ProvisioningLogs** if you need them. Under **Destination details**, select **Stream to an event hub** and choose your subscription, namespace, event hub, and policy. Select **Save**.

[![Azure Diagnostic setting page for Entra ID with audit and sign-in log categories selected and Stream to an event hub configured](/docs/assets/images/Untitled-27-d90725ea978011ad1e6774b5059640cc.webp)](https://coralogix.com/docs/assets/images/Untitled-27-d90725ea978011ad1e6774b5059640cc.webp)

Shows the Entra ID log categories alongside the Event Hub destination they stream to.

## Forward from the Event Hub [​](#forward-from-the-event-hub- "Direct link to forward-from-the-event-hub-")

Deploy the Azure Event Hub integration to collect the messages and submit them to Coralogix. Two deployment paths are available:

| Path                                                                                                                              | Use                         |
| --------------------------------------------------------------------------------------------------------------------------------- | --------------------------- |
| [Azure Event Hub ARM](https://coralogix.com/docs/integrations/azure/event-hub-microsoft-azure-resource-manager.md)                | Deploy from an ARM template |
| [ARM Event Hub integration package](https://coralogix.com/docs/integrations/azure/azure-resource-manager-integration-packages.md) | Deploy the packaged version |
| [Azure Event Hub Terraform](https://coralogix.com/docs/integrations/azure/azure-event-hub-terraform-module.md)                    | Deploy with Terraform       |

## Related resources[​](#related-resources "Direct link to Related resources")

[Introduction to Microsoft Azure](https://coralogix.com/docs/integrations/azure/introduction-to-microsoft-azure.md)[Azure resource logs](https://coralogix.com/docs/integrations/azure/azure-resource-logs.md)[Optional Azure configurations](https://coralogix.com/docs/integrations/azure/optional-configurations-microsoft-azure.md)