Azure Activity and Entra ID Connectors

Microsoft Sentinel is a cloud-native SIEM and SOAR solution that aggregates logs from various sources. Two of the most critical connectors are:

Both connectors are essential for detecting attacks that combine identity compromise with resource abuse—e.g., an attacker gaining access to a user account and then creating a VM to mine cryptocurrency.

Azure Activity Log Connector

The Activity Log is a native Azure service that retains events for 90 days by default. When you enable the connector in Sentinel, it does not copy the logs immediately; instead, it configures a diagnostic setting on the subscription (or a specific resource group) to stream Activity Log events to the Log Analytics workspace used by Sentinel. This is done via the Azure Monitor diagnostic settings API. - The diagnostic setting defines a destination: the Log Analytics workspace. It selects which categories of Activity Log events to stream. The categories are:

- Administrative (all write operations - PUT, POST, DELETE) - Alert (when an Azure alert fires) - Security (events from Azure Security Center or Azure Defender) - Service Health (Azure service health incidents) - Autoscale (autoscale operations) - Recommendation (recommendations from Azure Advisor) - Policy (Azure Policy evaluation events) - Resource Health (resource health status changes)

- For Sentinel, you typically stream the Administrative category because it contains the most security-relevant events (e.g., resource creation, deletion, role assignments). - Once streamed, events appear in the AzureActivity table in the Log Analytics workspace. Each event includes: - Caller: the user or service principal that performed the operation. - OperationName: the operation (e.g., "Microsoft.Compute/virtualMachines/write"). - Status: Succeeded, Failed, or Started. - EventTimestamp: time of the event. - ResourceId: the Azure resource identifier. - Authorization: RBAC details (scope, role, etc.). - The connector does not require any agent; it uses the Azure platform's built-in diagnostic settings. However, you must have appropriate permissions: Contributor or Owner at the subscription level to create diagnostic settings.

Entra ID Connector

This connector ingests audit and sign-in logs from Microsoft Entra ID. The data is sourced from the Microsoft Graph API (specifically the auditLogs endpoint). Sentinel uses a diagnostic setting on the Entra ID tenant to stream these logs to a Log Analytics workspace. Alternatively, you can use the legacy connector that polls the Graph API directly, but the diagnostic setting method is preferred for reliability and lower latency. - The diagnostic setting for Entra ID must be configured in the Azure portal > Microsoft Entra ID > Diagnostic settings. You can stream the following log categories: - AuditLogs: All directory changes (user, group, application, policy changes). - SignInLogs: All sign-in events (interactive, non-interactive, service principal, managed identity sign-ins). - NonInteractiveUserSignInLogs: Sign-ins performed by clients on behalf of users without user interaction. - ServicePrincipalSignInLogs: Sign-ins by service principals. - ManagedIdentitySignInLogs: Sign-ins by managed identities. - ProvisioningLogs: User provisioning events. - ADFSSignInLogs: Sign-ins from Active Directory Federation Services (ADFS) if integrated. - RiskyUsers: Users flagged as risky by Identity Protection. - UserRiskEvents: Risk detections for users. - For security monitoring, you typically stream AuditLogs, SignInLogs, and NonInteractiveUserSignInLogs because they cover most identity-based attacks. - The logs appear in the AuditLogs and SignInLogs tables in the workspace. Each record includes: - UserPrincipalName: the user who performed the action or signed in. - Operation: the operation (e.g., "Add user", "Update user"). - Result: Success or Failure. - TimeGenerated: timestamp. - IPAddress: the source IP address. - AppDisplayName: the application used. - The connector requires Global Administrator or Security Administrator permissions to configure the diagnostic setting. After configuration, logs stream with a latency of typically 2-5 minutes for audit logs and 5-10 minutes for sign-in logs.

Azure Activity Log Connector

AzureActivity
| take 10

If no data appears, check that the diagnostic setting exists:

az monitor diagnostic-settings list --subscription <subscription-id>

Entra ID Connector

AuditLogs
| take 10

Or:

SignInLogs
| take 10

If data is missing, verify the diagnostic setting in Entra ID > Diagnostic settings. Also ensure that the workspace is in the same tenant as Entra ID (cross-tenant streaming is not supported).

A large enterprise uses Sentinel to monitor for privilege escalation attacks. An attacker compromises a low-privileged user account through phishing. The attacker then uses Azure PowerShell to assign themselves a Contributor role on a subscription. The Azure Activity Log captures the role assignment operation (Microsoft.Authorization/roleAssignments/write) with the caller's UPN. Simultaneously, the Entra ID audit log captures the change to the user's directory object (if the role assignment involved a group membership change). Sentinel's analytics rule correlates the two: a user who has never performed role assignments suddenly does so from an unusual IP. The rule triggers an incident. Without both connectors, the detection would miss the role assignment (Activity Log) or the user context (Entra ID). In production, the enterprise streams all Administrative events and all AuditLogs and SignInLogs. They also enable UserRiskEvents to catch risky sign-ins. Performance considerations: they use a Log Analytics workspace with a 90-day retention and set daily ingestion cap to avoid cost spikes.

A company suspects data exfiltration from a storage account. The security team uses Sentinel to investigate. They query the AzureActivity table for any write operations to the storage account (e.g., Microsoft.Storage/storageAccounts/listKeys/action). They find that a service principal accessed the storage account keys. Then they query the SignInLogs table to see if that service principal had any unusual sign-ins (e.g., from an unexpected IP). They find that the service principal signed in from a known attacker IP. They also check AuditLogs to see if the service principal's permissions were changed recently. This investigation relies on both connectors. Common misconfiguration: if the diagnostic setting for Entra ID does not include ServicePrincipalSignInLogs, the investigation would miss the service principal sign-in. In production, they stream all sign-in log categories.

A regulated industry must track all resource deletions. They use the Azure Activity Log connector to capture delete operations (e.g., Microsoft.Compute/virtualMachines/delete). They also use Entra ID audit logs to see who performed the deletion. They set up Sentinel analytics rules to alert on any deletion outside business hours. They also archive Activity Logs to a storage account for long-term retention (beyond the 90-day default). Performance: they use Azure Policy to enforce diagnostic settings on all subscriptions. Common issue: if a subscription is moved to a new tenant, the diagnostic setting breaks and must be recreated. They monitor the connector health using Sentinel's data connectors health monitoring feature.