5.7 Enabling the Entra ID Connector

Enabling the Entra ID Connector

By the end of this subsection, you will have configured the Entra ID diagnostic settings to send sign-in and audit logs to your Sentinel workspace.

The M365 Defender connector brings device, email, and cloud app data. The Entra ID connector brings identity data — sign-in logs, audit logs, and provisioning logs. Together, they give your workspace the complete picture.

Why a separate connector?

Entra ID data is not part of the Defender XDR data pipeline. It flows through Azure Monitor diagnostic settings, not the Defender connector. This means you configure it separately, and it uses a different ingestion path.

Configuration

1. Navigate to Entra ID → Monitoring → Diagnostic settings
2. Click Add diagnostic setting
3. Name it: sentinel-signin-audit
4. Select the log categories to send:

Select these:

• SignInLogs (interactive sign-ins)
• NonInteractiveUserSignInLogs (token refreshes, API calls)
• AuditLogs (directory changes, app consents, group changes)
• ServicePrincipalSignInLogs (app-to-app authentication)
• RiskyUsers (identity protection risk events)
• UserRiskEvents (risk event details)

Optional (enable if needed):

• ManagedIdentitySignInLogs (Azure managed identity sign-ins)
• ProvisioningLogs (user provisioning events)
• ADFSSignInLogs (on-premises ADFS, if applicable)

5. Under Destination details, select Send to Log Analytics workspace
6. Select your Sentinel workspace
7. Click Save

Verification

1
2
3
4
5
6

union withsource=TableName
    SigninLogs,
    AADNonInteractiveUserSignInLogs,
    AuditLogs
| where TimeGenerated > ago(1h)
| summarize EventCount = count(), LastEvent = max(TimeGenerated) by TableName