First published on CloudBlogs on Jul, 26 2018
Today, we’re turning on the public preview of Azure AD Activity Logs in Azure Monitor (Azure’s platform-wide monitoring service) — offering you long-term retention as well as seamless integration. These improvements and new capabilities offer you:
Long-term retention by routing logs to your own Azure storage account.
Seamless SIEM integration without writing or maintaining any custom scripts.
Seamless integration with your own custom solutions, analytics tools or incident management solutions.
Many of our largest customers participated in the private preview of this feature. I’d like to thank all of them for their help and feedback. On average, they saw a 60 percent reduction in the time admins spent getting Azure AD Activity Logs. They also reported how easy the service is to use. Azure AD Activity Logs in Azure Monitor Diagnostics is simple to configure and only requires an
. With a simple click, you can route the logs to your storage account or Event Hub. In addition, you can set this up with your SIEM tool, custom apps, or any service management systems through Event Hub integration within minutes.
Here are some screenshots of configuring data with Azure Monitor, and viewing it with two of our SIEM partners, SumoLogic and Splunk:
Figure 1: Azure Monitor Diagnostic settings for Azure AD Logs.
Figure 2: Sumo logic app showing Azure AD Logs (integrated through Azure Monitor).
Figure 3: Sumo logic app based on Azure AD Logs (integrated through Azure Monitor Event Hub).
Figure 4: Splunk reports based on Azure AD Sign-ins.
This strategy for routing logs is consistent with other Azure resources as well. (You can find the
about which Azure resources offer this functionality.)
To help get you started with Azure AD Activity Logs in Azure Monitor Diagnostics, we’ve put together some helpful resources