Microsoft Graph Activity Logs (MicrosoftGraphActivityLogs) enabled correctly but table remains empty in Log Analytics/Sentinel

Brandon Mulgrew 0 Reputation points
2026-07-24T18:21:36.84+00:00

We have Microsoft Graph Activity Logs enabled as a category on our Microsoft Entra ID diagnostic setting, routed to a Log Analytics workspace with Microsoft Sentinel enabled. The category shows as checked/saved in both the Entra ID Diagnostic Settings blade and Sentinel's Data Connectors page (Microsoft Entra ID connector), but:

  • The MicrosoftGraphActivityLogs table is queryable in Log Analytics (no "table not found" error) but returns zero rows
  • On the Sentinel Data Connectors page, this specific data type never transitions to "Connected" status, even after explicitly disabling, applying changes, re-enabling, and applying changes again
  • Other Entra ID categories on the same diagnostic setting (SignInLogs, AuditLogs, AADNonInteractiveUserSignInLogs, etc.) are working correctly with recent data, as recent as today
  • Tenant is licensed for Microsoft Entra ID P1
  • Configuration was performed by an account with the Global Administrator role
  • We generated a deliberate, timestamped test call via Microsoft Graph PowerShell SDK (Get-MgOrganization) specifically to verify the pipeline; it has not appeared in the table well past the documented delivery window (30 minutes to 2 hours)

This appears isolated specifically to the Graph Activity Logs category, not a general licensing, permissions, or connector issue, since other categories on the identical diagnostic setting/connector are functioning normally. Has anyone encountered this specific failure mode, or is there an additional provisioning step required for this category beyond enabling it in the diagnostic setting/Sentinel connector?

Microsoft Security | Microsoft Sentinel
0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.