Our options when exporting logs are limited to a Storage account, Log Analytics or an Event Hub. And that is not something Azure does by default, but can be enabled: But sometimes, we need to go back further than 30 days.

Usually, we need real-time data because, for example, we’re debugging why that one user has conditional access issues. Take care when relying on Preview features in production.Īdditionally, you may also notice that there is no longer need for any kind of AAD license (P1/P2) for Sentinel customers to stream AAD logs.Often we, as cloud admins, need our audit or sign in logs.

Monitoring Service principal sign-ins with AzureAD and Azure Sentinel by Alex VerboonĭISCLAIMER: This feature enhancement is in Preview – meaning that things can change between Preview and Release.

Monitor Service Principal with Azure Sentinel by Eli Shlomo.

In the following resource links, you can skip the instructions about the Diagnostic Setting and just start utilizing the KQL goodness provided: There’s a couple blog posts I know of that speak specifically to monitoring Service Principal activity. Prior to this capability, you could still enable the logs, you’d just need to do it through the Diagnostic Setting for the service. The ability to enable these as part of the Data Connector is excellent value. To enable the additional ingest, open the specific Azure Active Directory Data Connector, place a checkmark beside the newly offered log files, and then click the Apply Changes button.

Managed Identity Sign-in logs (Preview).

Service principal sign-in logs (Preview).

Non-interactive user sign-in Log (Preview).The Azure Active Directory Data Connector has been updated to include the ability to choose the following additional logs: Once such recent update is valuable enough to take a look at today. As easy as it is (or not) to notice when new Data Connectors are available, it’s difficult to know when existing ones are updated. Over the past several weeks there’s a been a mighty movement in the Data Connector blade of Azure Sentinel, resulting in lots of new Data Connectors.

Azure ad log