Microsoft Entra connector for Microsoft Sentinel

Gain insights into Microsoft Entra ID by connecting Audit and Sign-in logs to Microsoft Sentinel to gather insights around Microsoft Entra scenarios. You can learn about app usage, conditional access policies, legacy auth relate details using our Sign-in logs. You can get information on your Self Service Password Reset (SSPR) usage, Microsoft Entra Management activities like user, group, role, app management using our Audit logs table. For more information, see the Microsoft Sentinel documentation.

Connector attributes

Connector attribute Description
Log Analytics table(s) SigninLogs
AuditLogs
AADNonInteractiveUserSignInLogs
AADServicePrincipalSignInLogs
AADManagedIdentitySignInLogs
AADProvisioningLogs
ADFSSignInLogs
AADUserRiskEvents
AADRiskyUsers
NetworkAccessTraffic
AADRiskyServicePrincipals
AADServicePrincipalRiskEvents
Data collection rules support Not currently supported
Supported by Microsoft Corporation

Next steps

For more information, go to the related solution in the Azure Marketplace.