You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/connect-azure-active-directory.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Send Microsoft Entra ID data to Microsoft Sentinel
3
3
description: Learn how to collect data from Microsoft Entra ID, and stream Microsoft Entra sign-in, audit, and provisioning logs into Microsoft Sentinel.
4
4
author: guywi-ms
5
5
ms.topic: how-to
6
-
ms.date: 07/03/2025
6
+
ms.date: 07/09/2025
7
7
ms.author: guywild
8
8
9
9
@@ -36,12 +36,12 @@ This table lists the logs you can send from Microsoft Entra ID to Microsoft Sent
|[**Audit logs**](../active-directory/reports-monitoring/concept-audit-logs.md)| System activity related to user and group management, managed applications, and directory activities. |[AuditLogs](/azure/azure-monitor/reference/tables/auditlogs)|
38
38
|[**Sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md)| Interactive user sign-ins where a user provides an authentication factor. |[SigninLogs](/azure/azure-monitor/reference/tables/signinlogs)|
39
-
|[**Non-interactive user sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md#non-interactive-user-sign-ins)(**Preview**) | Sign-ins performed by a client on behalf of a user without any interaction or authentication factor from the user. |[AADNonInteractiveUserSignInLogs](/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs)|
40
-
|[**Service principal sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md#service-principal-sign-ins)(**Preview**) | Sign-ins by apps and service principals that don't involve any user. In these sign-ins, the app or service provides a credential on its own behalf to authenticate or access resources. |[AADServicePrincipalSignInLogs](/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs)|
41
-
|[**Managed Identity sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md#managed-identity-for-azure-resources-sign-ins)(**Preview**) | Sign-ins by Azure resources that have secrets managed by Azure. For more information, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md). |[AADManagedIdentitySignInLogs](/azure/azure-monitor/reference/tables/aadmanagedidentitysigninlogs)|
39
+
|[**Non-interactive user sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md#non-interactive-user-sign-ins)| Sign-ins performed by a client on behalf of a user without any interaction or authentication factor from the user. |[AADNonInteractiveUserSignInLogs](/azure/azure-monitor/reference/tables/aadnoninteractiveusersigninlogs)|
40
+
|[**Service principal sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md#service-principal-sign-ins)| Sign-ins by apps and service principals that don't involve any user. In these sign-ins, the app or service provides a credential on its own behalf to authenticate or access resources. |[AADServicePrincipalSignInLogs](/azure/azure-monitor/reference/tables/aadserviceprincipalsigninlogs)|
41
+
|[**Managed Identity sign-in logs**](../active-directory/reports-monitoring/concept-all-sign-ins.md#managed-identity-for-azure-resources-sign-ins)| Sign-ins by Azure resources that have secrets managed by Azure. For more information, see [What are managed identities for Azure resources?](../active-directory/managed-identities-azure-resources/overview.md). |[AADManagedIdentitySignInLogs](/azure/azure-monitor/reference/tables/aadmanagedidentitysigninlogs)|
42
42
|[**AD FS sign-in logs**](/entra/identity/monitoring-health/concept-usage-insights-report#ad-fs-application-activity)| Sign-ins performed through Active Directory Federation Services (AD FS). |[ADFSSignInLogs](/azure/azure-monitor/reference/tables/adfssigninlogs)|
43
43
|[**Enriched Office 365 audit logs**](/entra/global-secure-access/how-to-view-enriched-logs)| Security events related to Microsoft 365 apps. |[EnrichedOffice365AuditLogs](/azure/azure-monitor/reference/tables/enrichedmicrosoft365auditlogs)|
44
-
|[**Provisioning logs**](../active-directory/reports-monitoring/concept-provisioning-logs.md)(**Preview**) | System activity information about users, groups, and roles provisioned by the Microsoft Entra provisioning service. |[AADProvisioningLogs](/azure/azure-monitor/reference/tables/aadprovisioninglogs)|
44
+
|[**Provisioning logs**](../active-directory/reports-monitoring/concept-provisioning-logs.md)| System activity information about users, groups, and roles provisioned by the Microsoft Entra provisioning service. |[AADProvisioningLogs](/azure/azure-monitor/reference/tables/aadprovisioninglogs)|
45
45
|[**Microsoft Graph activity logs**](/graph/microsoft-graph-activity-logs-overview)| HTTP requests accessing your tenant’s resources through the Microsoft Graph API. |[MicrosoftGraphActivityLogs](/azure/azure-monitor/reference/tables/microsoftgraphactivitylogs)|
46
46
|[**Network access traffic logs**](/entra/global-secure-access/how-to-view-traffic-logs)| Network access traffic and activities. |[NetworkAccessTraffic](/azure/azure-monitor/reference/tables/networkaccesstraffic)|
47
47
|[**Remote network health logs**](/entra/global-secure-access/how-to-remote-network-health-logs?tabs=microsoft-entra-admin-center)| Insights into the health of remote networks. |[RemoteNetworkHealthLogs](/azure/azure-monitor/reference/tables/remotenetworkhealthlogs)|
0 commit comments