Azure AD Logs shall be collected
Description
Azure AD logs should be a collected and periodically reviewed to detect any anomalies. Log information should be centralized in a SIEM tool, like Microsoft Sentinel, so that it can be audited and queried. Audit logs should be retained in a storage account for a minimum of 90 days.
Log events that can be collected are as follows: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, and ServicePrincipalRiskEvents.
Policy
Azure AD Log data is sent to a SIEM and/or external storage
Log data is periodically reviewed.
Log data is sent to an internal or external SOC for monitoring
Licensing Considerations
To retain Azure AD log data more than 7 days, an Azure AD P1 License is required. This license retains data for 30 days and is available to purchase standalone or as part of the following bundles:
Microsoft 365 Business Premium
EMS+ E3 or EMS + E5
Microsoft 365 E3
Microsoft 365 E5
Set Up Instructions
End-User Impact
There is no end user impact to review and collect Azure AD logs.
PowerShell Scripts
Videos
Last updated
