})
| [MaxMind](https://www.maxmind.com/en/home) | Automation integration: [MaxMind V2](/docs/platform-services/automation-service/app-central/integrations/maxmind-v2/) |
| })
| [McAfee](https://www.mcafee.com/) | Automation integrations: })
| [Memcached](https://memcached.org/) | Apps: }){kind=logo}
| [Microsoft](https://www.microsoft.com/) | Apps: }){kind=logo}
| [Mimecast](https://www.mimecast.com/) | App: [Mimecast](/docs/integrations/saas-cloud/mimecast/) }){kind=logo}
| [MindPoint Group](https://www.mindpointgroup.com/) | Cloud SIEM integration: [MindPoint Group](https://www.mindpointgroup.com/) | Cloud SIEM integration: [MindPoint Group](https://github.com/SumoLogic/cloud-siem-content-catalog/blob/master/vendors/f438572b-ed7f-4048-bb30-4a30c1babd81.md) |
| }){kind=logo}
| [Miro](https://miro.com/) | App: [Miro](/docs/integrations/saas-cloud/miro/) })
-### Troubleshooting metrics collection
+## Troubleshooting metrics collection
If metrics are not flowing into Sumo Logic, follow the steps below to investigate the problem.
-#### Verify Configurations
+### Verify Configurations
First, make sure that the resources you created above were successfully created.
@@ -82,7 +82,7 @@ Go to **Resource groups**, and select the resource group you created or selected
})
-#### Verify Event Hub is receiving metrics
+### Verify Event Hub is receiving metrics
To verify that events are appearing in your event hub:
@@ -92,7 +92,7 @@ To verify that events are appearing in your event hub:
})
-#### Verify the Event hub trigger configuration
+### Verify the Event hub trigger configuration
1. Go to **Resource groups**, and select the resource group you created or selected in [Step 2. Configure Azure resources using ARM Template](#step-2-configure-azure-resources-using-arm-template). Search for `SMFuncApp`. You should find the `SMFuncApp})
-#### Verify Sumo Logic HTTP source URL.
+### Verify Sumo Logic HTTP source URL.
1. Go to **Resource groups**, and select the resource group you created or selected in [Step 2. Configure Azure resources using ARM Template](#step-2-configure-azure-resources-using-arm-template). Search for `SMFuncApp`. You should find the `SMFuncApp})
@@ -110,7 +110,7 @@ To verify that events are appearing in your event hub:
1. Go to **Resource groups**, and select the resource group you created or selected in [Step 2. Configure Azure resources using ARM Template](#step-2-configure-azure-resources-using-arm-template). Search for `SMAppInsights`. You should find the `SMAppInsights})
-### Common errors
+## Common errors
For common error messages, refer [Event Hub export error messages](/docs/send-data/collect-from-other-data-sources/azure-monitoring/arm-integration-faq#event-hub-export-error-messages) section.
diff --git a/docs/send-data/hosted-collectors/index.md b/docs/send-data/hosted-collectors/index.md
index 8b5cc94bb3..5c0d608fd3 100644
--- a/docs/send-data/hosted-collectors/index.md
+++ b/docs/send-data/hosted-collectors/index.md
@@ -74,8 +74,8 @@ The maximum number of Collectors allowed per organization is 10,000.
- })
})
Microsoft Sources
-Collect Audit Log content types to track and monitor usage of MS 365.
+Microsoft Sources
+Collect data from your Microsoft platform and other products.
diff --git a/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md b/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md
index dc380a1fe6..55044b4e89 100644
--- a/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md
+++ b/docs/send-data/hosted-collectors/microsoft-source/azure-metrics-source.md
@@ -11,9 +11,7 @@ import useBaseUrl from '@docusaurus/useBaseUrl';
-
-
-})
+})
@@ -65,11 +63,11 @@ To configure the Azure Metrics Source:
1. **Azure Regions**. Select **All Regions**, if you want to collect metrics from all regions. Or, click **Select Regions** to select the region of your choice from the dropdown to collect metrics.
1. **Azure Namespaces**. Select **All Namespaces**, if you want to collect metrics with all namespaces. Or, click **Select Namespaces** to select the namespaces of your choice from the dropdown to collect metrics.
1. **Tags Filter**. Select any tag filter from the dropdown to enforce it with the each namespace. This helps you to further fine-tune from which resources you would like to collect metrics. It only supports resource tags which are custom user-configured key-value pairs on the azure resource. This approach allows for dynamic discovery, so for example if the resources are ephemeral or if any new resources are created in the same namespace, region and namespace are tagged with same key-value pairs as configured in the source, so their metrics can be collected automatically.
-1. **Scan Interval**. This option sets how often the source is scanned. Setting a shorter frequency increases message volume, and can cause your deployment to incur additional charges. The minimum acceptable scan interval is 1 minute.
+1. **Scan Interval**. This option sets how often the source is scanned. By default, the scan interval is set to 1 minute. Setting a shorter frequency increases message volume, and can cause your deployment to incur additional charges. The minimum acceptable scan interval is 1 minute.
1. **Processing Rules for Metrics (Optional)**. Configure any desired filters, such as allowlist and denylist, as described in [Metrics Include and Exclude Rules](/docs/send-data/collection/processing-rules/metrics-include-and-exclude-rules).
-## JSON configuration
+## JSON schema
### Configuration Object
@@ -93,3 +91,83 @@ To configure the Azure Metrics Source:
```json reference
https://github.com/SumoLogic/sumologic-documentation/blob/main/static/files/c2c/azure-metrics/example.json
```
+
+## Troubleshooting
+
+### Unable to authenticate to Azure
+
+During Source creation, if you encounter errors such as `Unable to get subscriptions. Please check credentials.` or `Unable to authenticate to Azure`.
+
+To rectify this ensure you verify your credentials are valid in the Azure portal by following the below steps:
+
+1. Sign in to the Azure portal.
+1. Navigate to app registrations and locate the app that was created during the **Deploy to Azure** process.
+1. Go to **Certificates & Secrets**.
+1. Ensure that a valid **Client Secret** exists. If no secret is present or the existing one has expired, create a new Client Secret.
+1. Retry the Source creation process using the updated credentials.
+
+### Subscriptions not present in the View Subscriptions list
+
+If the **View Subscriptions** list does not include expected Azure subscriptions, you can verify that the credentials have sufficient permission to read from the expected subscription. Another possible cause could be a propagation delay. After creating a new app or client secret, Azure may take up to 10 minutes to reflect the changes across its services. Wait a few minutes and refresh the list.
+
+Follow the steps below to verify and assign proper permissions:
+1. In the Azure portal, navigate to **Subscriptions**.
+1. Select the target subscription.
+1. Go to **Access Control (IAM)** > **Role assignments**.
+1. Confirm that the App created during the **Deploy to Azure** step is listed.
+1. Ensure it is assigned the **Monitoring Reader** role.
+
+### Missing metrics in Sumo Logic
+
+Azure Monitor displays all metrics, even those without data, but Sumo Logic only collects metrics with actual datapoints.
+If you know that certain metrics in Azure contain actual data (non-empty values) and you expected those metrics to appear in Sumo Logic, but they are missing, it’s recommended to reach out to Sumo Logic Support to resolve the issue.
+
+### API throttling by Microsoft
+
+If API requests to Azure are being throttled, resulting in failed or delayed metric ingestion, review and follow the guidance in the [Best Practices](#best-practices) section for reducing the frequency and volume of API calls.
+If you continue to experience throttling, reach out to Sumo Logic Support for assistance.
+
+## Best practices
+
+The Sumo Logic Azure Metrics Source uses the Azure Monitor API to retrieve metrics from your Azure environment. Following the best practices below will help reduce the number of API requests, avoid hitting Microsoft’s API throttling limits, and ensure efficient and reliable metric collection.
+
+### Limit one source per subscription
+
+Microsoft enforces API throttling for each subscription. Since each Sumo Logic Azure Metrics Source sends independent requests to the Azure Monitor API, Sumo Logic strongly recommends you to use only one Azure Metrics Source per Azure subscription.
+
+:::note
+A single Sumo Logic Source can collect metrics from multiple Azure subscriptions without issue. However, avoid assigning more than one Source to collect from the same subscription, as this may lead to throttling.
+:::
+
+### Increase the scan interval to reduce API load
+
+The scan interval determines how often the Azure Metrics Source queries the Azure Monitor API. Adjusting this interval can significantly impact API usage:
+- Shorter scan intervals (for example, 1 minute) result in more frequent API calls.
+- Longer scan intervals reduce the request rate, helping to avoid throttling—especially in environments with a high number of resources.
+
+#### Recommended scan interval guidelines
+
+| Scan Interval | Maximum Resources per Subscription | Maximum VMs per Subscription for Virtual Machine Guest metrics |
+|:--|:--|:--|
+| 1 minute | 20,000 (3,000 for users on Azure Sovereign Cloud) | 600 (80 for users on Azure Sovereign Cloud) |
+| 5 minutes | 100,000 (15,000 for users on Azure Sovereign Cloud)| 3,000 (400 for users on Azure Sovereign Cloud) |
+
+By default, the scan interval is set to 1 minute. For a larger number of resources, increase the scan interval further using the Sumo Logic Source Management API.
+
+:::note
+Increasing the scan interval does not reduce metric granularity. The frequency of data collection changes, but the resolution of data points remains unaffected.
+:::
+
+### Estimate API request rate per subscription
+
+The API request rate for the Azure Metrics Source depends on the scan interval and the number of resources in a subscription. Since Microsoft enforces API throttling per subscription, you can estimate the rate of requests made per subscription using the following formula:
+
+`(CEILING((T / 50) / N) * N * (180 / S)) + (V * (144 / S))`
+
+Where,
+T = Total number of non-VM resources
+V = Total number of VMs (only for users collecting Virtual Machine Guest metrics)
+N = Number of distinct namespaces with active resources
+S = Scan Interval (in minutes)
+
+Understanding this rate helps you proactively configure your Sources to stay within Microsoft’s service limits and avoid interruptions due to throttling.
\ No newline at end of file
diff --git a/docs/send-data/hosted-collectors/microsoft-source/index.md b/docs/send-data/hosted-collectors/microsoft-source/index.md
new file mode 100644
index 0000000000..37f32a548d
--- /dev/null
+++ b/docs/send-data/hosted-collectors/microsoft-source/index.md
@@ -0,0 +1,28 @@
+---
+slug: /send-data/hosted-collectors/microsoft-source
+title: Microsoft Sources
+description: Sumo Logic offers Sources to collect from many Microsoft products.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+Sumo Logic offers hosted Sources to collect data from Microsoft products.
+
+## Guide contents
+
+In this section, we'll introduce the following concepts:
+
+
+
@@ -65,11 +63,11 @@ To configure the Azure Metrics Source:
1. **Azure Regions**. Select **All Regions**, if you want to collect metrics from all regions. Or, click **Select Regions** to select the region of your choice from the dropdown to collect metrics.
1. **Azure Namespaces**. Select **All Namespaces**, if you want to collect metrics with all namespaces. Or, click **Select Namespaces** to select the namespaces of your choice from the dropdown to collect metrics.
1. **Tags Filter**. Select any tag filter from the dropdown to enforce it with the each namespace. This helps you to further fine-tune from which resources you would like to collect metrics. It only supports resource tags which are custom user-configured key-value pairs on the azure resource. This approach allows for dynamic discovery, so for example if the resources are ephemeral or if any new resources are created in the same namespace, region and namespace are tagged with same key-value pairs as configured in the source, so their metrics can be collected automatically.
-1. **Scan Interval**. This option sets how often the source is scanned. Setting a shorter frequency increases message volume, and can cause your deployment to incur additional charges. The minimum acceptable scan interval is 1 minute.
+1. **Scan Interval**. This option sets how often the source is scanned. By default, the scan interval is set to 1 minute. Setting a shorter frequency increases message volume, and can cause your deployment to incur additional charges. The minimum acceptable scan interval is 1 minute.
1. **Processing Rules for Metrics (Optional)**. Configure any desired filters, such as allowlist and denylist, as described in [Metrics Include and Exclude Rules](/docs/send-data/collection/processing-rules/metrics-include-and-exclude-rules).
-## JSON configuration
+## JSON schema
### Configuration Object
@@ -93,3 +91,83 @@ To configure the Azure Metrics Source:
```json reference
https://github.com/SumoLogic/sumologic-documentation/blob/main/static/files/c2c/azure-metrics/example.json
```
+
+## Troubleshooting
+
+### Unable to authenticate to Azure
+
+During Source creation, if you encounter errors such as `Unable to get subscriptions. Please check credentials.` or `Unable to authenticate to Azure`.
+
+To rectify this ensure you verify your credentials are valid in the Azure portal by following the below steps:
+
+1. Sign in to the Azure portal.
+1. Navigate to app registrations and locate the app that was created during the **Deploy to Azure** process.
+1. Go to **Certificates & Secrets**.
+1. Ensure that a valid **Client Secret** exists. If no secret is present or the existing one has expired, create a new Client Secret.
+1. Retry the Source creation process using the updated credentials.
+
+### Subscriptions not present in the View Subscriptions list
+
+If the **View Subscriptions** list does not include expected Azure subscriptions, you can verify that the credentials have sufficient permission to read from the expected subscription. Another possible cause could be a propagation delay. After creating a new app or client secret, Azure may take up to 10 minutes to reflect the changes across its services. Wait a few minutes and refresh the list.
+
+Follow the steps below to verify and assign proper permissions:
+1. In the Azure portal, navigate to **Subscriptions**.
+1. Select the target subscription.
+1. Go to **Access Control (IAM)** > **Role assignments**.
+1. Confirm that the App created during the **Deploy to Azure** step is listed.
+1. Ensure it is assigned the **Monitoring Reader** role.
+
+### Missing metrics in Sumo Logic
+
+Azure Monitor displays all metrics, even those without data, but Sumo Logic only collects metrics with actual datapoints.
+If you know that certain metrics in Azure contain actual data (non-empty values) and you expected those metrics to appear in Sumo Logic, but they are missing, it’s recommended to reach out to Sumo Logic Support to resolve the issue.
+
+### API throttling by Microsoft
+
+If API requests to Azure are being throttled, resulting in failed or delayed metric ingestion, review and follow the guidance in the [Best Practices](#best-practices) section for reducing the frequency and volume of API calls.
+If you continue to experience throttling, reach out to Sumo Logic Support for assistance.
+
+## Best practices
+
+The Sumo Logic Azure Metrics Source uses the Azure Monitor API to retrieve metrics from your Azure environment. Following the best practices below will help reduce the number of API requests, avoid hitting Microsoft’s API throttling limits, and ensure efficient and reliable metric collection.
+
+### Limit one source per subscription
+
+Microsoft enforces API throttling for each subscription. Since each Sumo Logic Azure Metrics Source sends independent requests to the Azure Monitor API, Sumo Logic strongly recommends you to use only one Azure Metrics Source per Azure subscription.
+
+:::note
+A single Sumo Logic Source can collect metrics from multiple Azure subscriptions without issue. However, avoid assigning more than one Source to collect from the same subscription, as this may lead to throttling.
+:::
+
+### Increase the scan interval to reduce API load
+
+The scan interval determines how often the Azure Metrics Source queries the Azure Monitor API. Adjusting this interval can significantly impact API usage:
+- Shorter scan intervals (for example, 1 minute) result in more frequent API calls.
+- Longer scan intervals reduce the request rate, helping to avoid throttling—especially in environments with a high number of resources.
+
+#### Recommended scan interval guidelines
+
+| Scan Interval | Maximum Resources per Subscription | Maximum VMs per Subscription for Virtual Machine Guest metrics |
+|:--|:--|:--|
+| 1 minute | 20,000 (3,000 for users on Azure Sovereign Cloud) | 600 (80 for users on Azure Sovereign Cloud) |
+| 5 minutes | 100,000 (15,000 for users on Azure Sovereign Cloud)| 3,000 (400 for users on Azure Sovereign Cloud) |
+
+By default, the scan interval is set to 1 minute. For a larger number of resources, increase the scan interval further using the Sumo Logic Source Management API.
+
+:::note
+Increasing the scan interval does not reduce metric granularity. The frequency of data collection changes, but the resolution of data points remains unaffected.
+:::
+
+### Estimate API request rate per subscription
+
+The API request rate for the Azure Metrics Source depends on the scan interval and the number of resources in a subscription. Since Microsoft enforces API throttling per subscription, you can estimate the rate of requests made per subscription using the following formula:
+
+`(CEILING((T / 50) / N) * N * (180 / S)) + (V * (144 / S))`
+
+Where,
+T = Total number of non-VM resources
+V = Total number of VMs (only for users collecting Virtual Machine Guest metrics)
+N = Number of distinct namespaces with active resources
+S = Scan Interval (in minutes)
+
+Understanding this rate helps you proactively configure your Sources to stay within Microsoft’s service limits and avoid interruptions due to throttling.
\ No newline at end of file
diff --git a/docs/send-data/hosted-collectors/microsoft-source/index.md b/docs/send-data/hosted-collectors/microsoft-source/index.md
new file mode 100644
index 0000000000..37f32a548d
--- /dev/null
+++ b/docs/send-data/hosted-collectors/microsoft-source/index.md
@@ -0,0 +1,28 @@
+---
+slug: /send-data/hosted-collectors/microsoft-source
+title: Microsoft Sources
+description: Sumo Logic offers Sources to collect from many Microsoft products.
+---
+
+import useBaseUrl from '@docusaurus/useBaseUrl';
+
+Sumo Logic offers hosted Sources to collect data from Microsoft products.
+
+## Guide contents
+
+In this section, we'll introduce the following concepts:
+
+
+
\ No newline at end of file
diff --git a/sidebars.ts b/sidebars.ts
index bb7ad7408a..a9f1a87c58 100644
--- a/sidebars.ts
+++ b/sidebars.ts
@@ -547,7 +547,9 @@ module.exports = {
label: 'Microsoft Sources',
collapsible: true,
collapsed: true,
+ link: {type: 'doc', id: 'send-data/hosted-collectors/microsoft-source/index'},
items: [
+ 'send-data/hosted-collectors/microsoft-source/azure-metrics-source',
'send-data/hosted-collectors/microsoft-source/ms-office-audit-source',
],
},
diff --git a/static/img/send-data/Azure-metrics.png b/static/img/send-data/Azure-metrics.png
index 1b18921b0f..7b4584f690 100644
Binary files a/static/img/send-data/Azure-metrics.png and b/static/img/send-data/Azure-metrics.png differ
diff --git a/static/img/send-data/microsoft.png b/static/img/send-data/microsoft.png
new file mode 100644
index 0000000000..11feffc1d8
Binary files /dev/null and b/static/img/send-data/microsoft.png differ
diff --git a/static/img/send-data/ms-azure-metrics.svg b/static/img/send-data/ms-azure-metrics.svg
new file mode 100644
index 0000000000..7b4584f690
--- /dev/null
+++ b/static/img/send-data/ms-azure-metrics.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
+
+
+ 
+Azure Metrics Source
+Learn how to configure Azure Metrics Source for Sumo Logic ingestion.
+
+
+
+ 
+Microsoft Office 365 Audit Source
+Learn how to configure Microsoft Office 365 Audit Source for Sumo Logic ingestion.
+