However, different types of events have different schema, which complicates parsing the events audit file.

If you do not see logs appearing in the selected destination after 15 minutes, sign out and back into Azure to refresh the logs.You can export events from the Event Viewer.

Send to partner solution: Select the appropriate details from the menus that appear.Stream to an event hub: Select the appropriate details from the menus that appear.Select the appropriate details from the menus that appear. Archive to a storage account: Provide the number of days you'd like to retain the data in the Retention days boxes that appear next to the log categories.Send to Log Analytics workspace: Select the appropriate details from the menus that appear.Additional fields appear, depending on your selection. Choose any or all of the following destinations. Select the Destination details for where you'd like to send the logs. At this time, selecting these options will not add new logs to your workspace unless your organization was included in the preview. The following logs are in preview but still visible in Azure AD. ADFSSignInLogs Active Directory Federation Services (ADFS).Some logs may be in public preview but still visible in the portal. If you're editing an existing integration, you can't change the name.Īny or all of the following logs can be sent to the Log Analytics workspace. Select + Add diagnostic setting to create a new integration or select Edit setting for an existing integration.Įnter a Diagnostic setting name. You can also select Export Settings from either the Audit Logs or Sign-ins page. Go to Azure Active Directory > Diagnostic settings. Sign in to the Azure portal as a Security Administrator or Global Administrator. Looking for how to set up Log Analytics workspace for Azure resources outside of Azure AD? Check out the Collect and view resource logs for Azure Monitor article. Learn how to create a Log Analytics workspace.įollow the steps below to send logs from Azure Active Directory to Azure Monitor. A Log Analytics workspace in your Azure subscription.Global Administrator or Security Administrator access for the Azure AD tenant.You can find the license type of your tenant on the Overview page in Azure AD. If you don't have an Azure subscription, you can sign up for a free trial.

Aad logs