Forum Discussion

CSI's avatar
CSI
Copper Contributor
Mar 14, 2025
Solved

Specify which Entra ID Sign-in logs are sent to Log Analytics Workspace

Hi, as the title says I am curious if its possible if I can limit which login logs are sent to a Log Analytics Workspace. We currently have a couple of service accounts in use that generate a high am...
entra id
Log Analytics Workspace
Sign-in Logs
  • micheleariis's avatar
    micheleariis
    Mar 17, 2025

    Hi, no, currently you cannot directly filter which EntraID sign-in logs are sent to log analytics workspace (LAW). All configured sign-in logs are forwarded without user- or group-level granularity.

    The only workaround is to filter the data using kql once the logs are already in LAW. If you want to reduce costs or noise in reports, you can set up queries to exclude service accounts from alerts or dashboards.

micheleariis's avatar
micheleariis
MCT
Mar 17, 2025

Hi, no, currently you cannot directly filter which EntraID sign-in logs are sent to log analytics workspace (LAW). All configured sign-in logs are forwarded without user- or group-level granularity.

The only workaround is to filter the data using kql once the logs are already in LAW. If you want to reduce costs or noise in reports, you can set up queries to exclude service accounts from alerts or dashboards.

Resources