A cloud-native SIEM solution that provides intelligent security analytics and threat detection across systems
Microsoft Graph Activity Logs (MicrosoftGraphActivityLogs) enabled correctly but table remains empty in Log Analytics/Sentinel
We have Microsoft Graph Activity Logs enabled as a category on our Microsoft Entra ID diagnostic setting, routed to a Log Analytics workspace with Microsoft Sentinel enabled. The category shows as checked/saved in both the Entra ID Diagnostic Settings blade and Sentinel's Data Connectors page (Microsoft Entra ID connector), but:
- The MicrosoftGraphActivityLogs table is queryable in Log Analytics (no "table not found" error) but returns zero rows
- On the Sentinel Data Connectors page, this specific data type never transitions to "Connected" status, even after explicitly disabling, applying changes, re-enabling, and applying changes again
- Other Entra ID categories on the same diagnostic setting (SignInLogs, AuditLogs, AADNonInteractiveUserSignInLogs, etc.) are working correctly with recent data, as recent as today
- Tenant is licensed for Microsoft Entra ID P1
- Configuration was performed by an account with the Global Administrator role
- We generated a deliberate, timestamped test call via Microsoft Graph PowerShell SDK (Get-MgOrganization) specifically to verify the pipeline; it has not appeared in the table well past the documented delivery window (30 minutes to 2 hours)
This appears isolated specifically to the Graph Activity Logs category, not a general licensing, permissions, or connector issue, since other categories on the identical diagnostic setting/connector are functioning normally. Has anyone encountered this specific failure mode, or is there an additional provisioning step required for this category beyond enabling it in the diagnostic setting/Sentinel connector?