Microsoft Graph Activity Logs (MicrosoftGraphActivityLogs) enabled correctly but table remains empty in Log Analytics/Sentinel

Question

We have Microsoft Graph Activity Logs enabled as a category on our Microsoft Entra ID diagnostic setting, routed to a Log Analytics workspace with Microsoft Sentinel enabled. The category shows as checked/saved in both the Entra ID Diagnostic Settings blade and Sentinel's Data Connectors page (Microsoft Entra ID connector), but:

• The MicrosoftGraphActivityLogs table is queryable in Log Analytics (no "table not found" error) but returns zero rows
• On the Sentinel Data Connectors page, this specific data type never transitions to "Connected" status, even after explicitly disabling, applying changes, re-enabling, and applying changes again
• Other Entra ID categories on the same diagnostic setting (SignInLogs, AuditLogs, AADNonInteractiveUserSignInLogs, etc.) are working correctly with recent data, as recent as today
• Tenant is licensed for Microsoft Entra ID P1
• Configuration was performed by an account with the Global Administrator role
• We generated a deliberate, timestamped test call via Microsoft Graph PowerShell SDK (Get-MgOrganization) specifically to verify the pipeline; it has not appeared in the table well past the documented delivery window (30 minutes to 2 hours)

This appears isolated specifically to the Graph Activity Logs category, not a general licensing, permissions, or connector issue, since other categories on the identical diagnostic setting/connector are functioning normally. Has anyone encountered this specific failure mode, or is there an additional provisioning step required for this category beyond enabling it in the diagnostic setting/Sentinel connector?

Answer 1

Hello @Brandon Mulgrew and @Casey ,

There is no additional provisioning step required. Enabling MicrosoftGraphActivityLogs in the Microsoft Entra diagnostic settings and selecting the Log Analytics workspace should be sufficient. A Microsoft Entra ID P1 or P2 tenant licence is required, and Global Administrator has sufficient permissions

Please note that Microsoft states that new diagnostic logs can take up to three days to start appearing. The Sentinel connector will also remain Not connected until data is actually received in the table

However, since the configuration has already been active for more than three days, other Entra log categories are reaching the same workspace, and a test Graph request still produced no event, this is not expected behaviour.

As a final test, verify that the tenant shown by Get-MgContext matches the tenant where the diagnostic setting is configured. It would also be useful to temporarily send Microsoft Graph activity logs to a Storage account or Event Hub. If no records appear there either, the logs are not being emitted by the tenant rather than being lost during Log Analytics ingestion.