Ingest Unified Audit Log into Log Analytics

Question

I have 2 Tenants. I would like to send all of the Unified Audit Log from M365 Tenant A to log analytics for storage, alerts, etc in Tenant B.

How can I ingest it?

I do NOT mean only Azure Log-Ins which I can send by adding a Diagnostics Settings in Azure Portal. I mean all of the workloads available in Unified Audit Log.

I found https://practical365.com/use-office-365-audit-data-with-microsoft-sentinel/ which seems to tackle what I want, but it looks like the Data Connector works only within the same tenant. Can I customize it?

If not, what other ways are there? Should I write maybe an Azure Function reading from the Unified Audit Log and inputting into Log Analytics Workspace? It seems weird...

Answer 1

@Ano Acco Thank you for reaching out to us, researched on your ask where you want to send all of the Unified Audit Log from M365 Tenant A to log analytics for storage, alerts, etc in Tenant B.

Similar requirement has been discussed over here - https://techcommunity.microsoft.com/t5/microsoft-sentinel/sending-logs-from-one-tenant-to-a-different-tenant-sentinel/m-p/2185531 where recommended approach is to use Azure functions.

However will also check with my team on the same and keep you posted once i have the response.

Let me know if you have any further questions, feel free to post back.