# Microsoft Entra ID logs

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Fazure%2Fmicrosoft-entra-id-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Fazure%2Fmicrosoft-entra-id-logs.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Collect Microsoft Entra ID (previously Azure Active Directory) **audit**, **sign-in**, and **provisioning** logs, and submit them to Coralogix for seamless integration.

## Overview[​](#overview "Direct link to Overview")

Sign-in and audit logs comprise the activity logs behind many Microsoft Entra ID reports, which can be used to analyze, monitor, and troubleshoot activity in your tenant. Routing your activity logs to an analysis and monitoring solution provides greater insights into your tenant's health and security.

Activity logs help you understand the behavior of users in your organization. There are three types of activity logs in Microsoft Entra ID:

* [Audit logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs) include the history of every task performed in your tenant.

* [Sign-in logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins) capture the sign-in attempts of your users and client applications.

* [Provisioning logs](https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-provisioning-logs) provide information about users provisioned in your tenant through a third-party service.

This tutorial demonstrates how to collect Microsoft Entra ID audit and sign-in logs and submit them to Coralogix. It requires that you configure your Microsoft Entra ID Diagnostic Settings and leverage our [Event Hub integration](https://docs-docusaurus.kinsta.page/integrations/azure/event-hub-microsoft-azure-resource-manager/.md) for the collection and submission of those logs to the Coralogix platform.

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

* Microsoft Entra ID account with an active subscription \[**Note**: To export sign-in data, you’ll need a P1 or P2 Microsoft Entra ID license.]

* EventHub Namespace \[**Note**: If your EventHub has restricted public access you will need to enable VNet support using these [optional configuration steps](https://docs-docusaurus.kinsta.page/integrations/azure/optional-configurations-microsoft-azure/.md).]

## Audit and Sign-in Log Export[​](#audit-and-sign-in-log-export "Direct link to Audit and Sign-in Log Export")

**STEP 1**. To configure audit and sign-in exports, navigate to your Microsoft Entra ID resource.

**STEP 2**. Under Monitoring, click **Diagnostic Settings**.

**STEP 3**. Click **+ Add diagnostic setting**.

**STEP 4**. In the Diagnostic Setting window, select your desired **Categories** and configure the **Destination details** to submit entries to your existing Event Hub.

[![Azure Active Directory Logs to Coralogix](/assets/images/Untitled-27-d90725ea978011ad1e6774b5059640cc.webp)](https://docs-docusaurus.kinsta.page/assets/images/Untitled-27-d90725ea978011ad1e6774b5059640cc.webp)

## Process Event Hub[​](#process-event-hub "Direct link to Process Event Hub")

Now that your audit and sign-in log entries are being exported to your Event Hub, you’ll need to deploy the Azure Event Hub integration to collect and submit the messages to the Coralogix platform.

Deploy the integration via ARM template or Terraform.

* ARM

  * [Azure Event Hub ARM](https://docs-docusaurus.kinsta.page/integrations/azure/event-hub-microsoft-azure-resource-manager/.md)

  * [ARM Event Hub Integration Package](https://docs-docusaurus.kinsta.page/integrations/azure/azure-resource-manager-integration-packages/.md)

* Terraform

  * [Azure Event Hub Terraform](https://docs-docusaurus.kinsta.page/integrations/azure/azure-event-hub-terraform-module/.md)

## Additional Resources[​](#additional-resources "Direct link to Additional Resources")

|               |                                                                                                                               |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------- |
| Documentation | [Introduction to Microsoft Azure](https://docs-docusaurus.kinsta.page/integrations/azure/introduction-to-microsoft-azure/.md) |