Microsoft Entra ID logs
Microsoft Entra ID (previously Azure Active Directory) records tenant activity in three log types, and they sit behind many of its built-in reports. Routing them to Coralogix puts identity activity next to the rest of your telemetry, where it can be correlated and alerted on.
| Log type | Contains |
|---|---|
| Audit logs | Every task performed in your tenant |
| Sign-in logs | Sign-in attempts by users and client applications |
| Provisioning logs | Users provisioned into your tenant by a third-party service |
Collection takes two moves: a diagnostic setting that streams the logs to an Event Hub, and the Event Hub integration that forwards from there.
What you need
- A Microsoft Entra ID account with an active subscription. Exporting sign-in data additionally requires a P1 or P2 Entra ID license.
- An Event Hub namespace. If yours restricts public access, enable VNet support first. See the optional configuration steps.
Export the logs to an Event Hub
Navigate to your Microsoft Entra ID resource, then select Diagnostic settings under Monitoring.
Select Add diagnostic setting and give it a name.
Select the categories you want. AuditLogs and SignInLogs at minimum, plus the sign-in variants and ProvisioningLogs if you need them. Under Destination details, select Stream to an event hub and choose your subscription, namespace, event hub, and policy. Select Save.
Shows the Entra ID log categories alongside the Event Hub destination they stream to.
Forward from the Event Hub
Deploy the Azure Event Hub integration to collect the messages and submit them to Coralogix. Two deployment paths are available:
| Path | Use |
|---|---|
| Azure Event Hub ARM | Deploy from an ARM template |
| ARM Event Hub integration package | Deploy the packaged version |
| Azure Event Hub Terraform | Deploy with Terraform |