Lesson 22 — Microsoft Entra Diagnostic Settings
Microsoft Entra records valuable identity activity, but portal retention alone is not a complete monitoring strategy.
Diagnostic Settings route selected audit, sign-in, provisioning, risk and workload identity logs to destinations designed for investigation, long-term retention and integration. Those destinations can include a Log Analytics workspace, Microsoft Sentinel, an Event Hub or an Azure Storage account.
This lesson explains how to select the right log categories, configure each destination, validate ingestion, control cost and avoid the visibility gaps caused by incomplete diagnostic settings.
What you will learn
This lesson explains how Microsoft Entra activity logs are exported, retained and made available to security operations.
Learning objectives
After completing this lesson, you should be able to design, configure and validate Microsoft Entra Diagnostic Settings.
- Explain why Microsoft Entra logs should be exported.
- Select the log categories required for security and operations.
- Compare Log Analytics, Event Hubs and Azure Storage destinations.
- Connect Entra telemetry to Microsoft Sentinel.
- Validate ingestion and troubleshoot missing data.
- Balance visibility, retention and ingestion cost.
The problem this solves
Identity evidence can disappear from the portal before an investigation, audit or legal request begins.
Diagnostic Settings create a controlled export path so important activity remains searchable, retainable and available to downstream security platforms.
What are Microsoft Entra Diagnostic Settings?
Diagnostic Settings are tenant-level export configurations that route selected Microsoft Entra activity logs to one or more supported destinations.
Where to configure them
In the Microsoft Entra admin centre, browse to Entra ID → Monitoring & health → Diagnostic settings.
You can also reach the export configuration from the Audit logs or Sign-in logs experience.
Permissions and prerequisites
The administrator needs an appropriate Microsoft Entra role and permission to configure the selected Azure destination.
The destination subscription and tenant relationship must also support the intended routing design.
Core log categories
The available categories can evolve, so review the current list whenever a setting is created or audited.
| Category | What it records | Why it matters |
|---|---|---|
| AuditLogs | Directory, application, group, role and policy changes | Tracks who changed identity configuration and what changed |
| SignInLogs | Interactive user authentication activity | Supports user sign-in investigation and Conditional Access analysis |
| NonInteractiveUserSignInLogs | Token activity without an interactive prompt | Reveals background application and refresh-token activity |
| ServicePrincipalSignInLogs | Application identity authentication | Monitors workload identities, automation and app-only access |
| ManagedIdentitySignInLogs | Azure resource managed identity authentication | Provides visibility into token requests made by Azure resources |
| ProvisioningLogs | User and group provisioning operations | Helps troubleshoot synchronisation and lifecycle failures |
| Risk-related logs | Identity Protection detections and risky activity | Supports investigation of compromised users and workload identities |
Log Analytics workspace
Sending logs to a Log Analytics workspace makes them available to Azure Monitor Logs and KQL.
This destination is ideal for investigation, workbooks, alerting and operational reporting.
Microsoft Sentinel
Microsoft Sentinel uses a Log Analytics workspace, so Entra logs routed to that workspace become available for analytics rules, incidents, workbooks and threat hunting.
Diagnostic Settings provide the data path; Sentinel provides the security operations layer.
Azure Storage
A Storage account supports economical long-term archival and retention requirements.
Storage is useful when evidence must be preserved beyond portal retention, but it is not as convenient as Log Analytics for immediate investigation.
Event Hubs
Event Hubs stream Entra activity to external SIEM platforms, data pipelines or custom consumers.
This destination is appropriate when another platform must receive identity telemetry continuously.
One setting or several?
Microsoft Entra supports multiple diagnostic settings, allowing different log categories to be routed to different destinations.
Diagnostic Setting 2 → Required categories → Storage archive
Diagnostic Setting 3 → Selected streams → Event Hub → External SIEM
Use clear names so administrators can understand the purpose of each route without opening every setting.
Select categories deliberately
Do not assume that selecting one sign-in category captures every type of authentication.
Interactive users, non-interactive users, service principals and managed identities produce distinct telemetry.
Avoid the “all logs forever” shortcut
Collecting every available category can improve coverage, but it can also create unnecessary ingestion and retention cost.
Start with investigation and compliance requirements, then document why each category is enabled.
Retention design
Retention should match operational, regulatory and incident-response requirements.
Use Log Analytics for searchable operational data and Storage when longer, lower-cost archival is needed.
Cost considerations
Log volume varies substantially between interactive users, background token traffic and workload identities.
Measure ingestion after deployment and review high-volume categories rather than estimating solely from user count.
Configuration workflow
- Open Microsoft Entra Diagnostic Settings.
- Select Add diagnostic setting.
- Give the setting a descriptive name.
- Select the required log categories.
- Select one or more destinations.
- Choose the target workspace, Storage account or Event Hub.
- Save the setting.
- Generate or identify known activity.
- Validate that the expected destination receives the event.
- Record the configuration in the tenant monitoring standard.
Validate Log Analytics ingestion
Open the target workspace and query the expected Entra tables after allowing time for ingestion.
Validate audit events
Perform a known administrative change or identify a recent change, then confirm that the event appears in the audit table.
Validate workload identities
Application and managed identity activity should be tested independently from user sign-ins.
A healthy interactive sign-in table does not prove that workload identity categories are enabled.
Check the destination, not just the setting
A saved setting confirms configuration, not successful ingestion.
Verify the target resource, tenant, subscription, permissions and table arrival before declaring the deployment complete.
Agent Foskett investigation: “The user sign-ins are visible, but the application activity is missing”
The SOC could investigate user sign-ins in Sentinel, but a suspicious application had no corresponding service principal events.
- Agent Foskett confirmed that interactive SigninLogs were arriving.
- The Diagnostic Setting was opened and reviewed category by category.
- ServicePrincipalSignInLogs had never been selected.
- The category was enabled and the setting was saved.
- A controlled application authentication generated a known event.
- The event appeared in the workload identity table after ingestion.
- The tenant monitoring checklist was updated to require separate validation for every identity type.
Common causes of missing logs
- The required category is not selected.
- The wrong Log Analytics workspace was chosen.
- The Event Hub or Storage destination belongs to an unexpected subscription.
- The test activity did not generate the expected log type.
- The query uses the wrong table or time range.
- Ingestion delay is mistaken for permanent failure.
Common deployment mistakes
- Enabling only interactive SignInLogs.
- Assuming Microsoft Sentinel automatically receives every Entra category.
- Failing to validate a known event after configuration.
- Using unclear setting names.
- Ignoring cost and retention design.
- Never reviewing new categories introduced by Microsoft.
Operational review checklist
- Confirm every required category remains selected.
- Confirm each destination still exists and is authorised.
- Run sample KQL against the expected tables.
- Review ingestion volume and retention.
- Document setting ownership and change control.
- Reassess the available category list periodically.
Security best practices
- Separate emergency retention from day-to-day analytics where appropriate.
- Protect destination resources with least privilege.
- Monitor changes to diagnostic settings.
- Include workload identity telemetry in the monitoring design.
- Test ingestion after every material configuration change.
Key takeaways
- Microsoft Entra Diagnostic Settings export selected identity activity to supported destinations.
- Log Analytics enables KQL, Azure Monitor and Microsoft Sentinel investigation.
- Azure Storage supports long-term archival.
- Event Hubs support streaming to external platforms and pipelines.
- Different identity types use different sign-in categories.
- A saved configuration must still be validated at the destination.
- Collection scope, retention and cost should be deliberately designed.
- Missing telemetry is often caused by an unselected category rather than a broken pipeline.
Related Agent Foskett resources
Continue learning
Microsoft Entra Diagnostic Settings, Log Analytics and Microsoft Sentinel
Microsoft Entra Diagnostic Settings route audit logs, interactive and non-interactive sign-ins, service principal sign-ins, managed identity sign-ins, provisioning logs and risk telemetry to Log Analytics, Microsoft Sentinel, Event Hubs and Azure Storage.
Microsoft Entra Academy Lesson 22 — Diagnostic Settings
This Agent Foskett lesson explains log category selection, destination design, retention, cost management, KQL validation and investigation of missing Microsoft Entra telemetry.
