azure:tenant
Azure and Entra ID tenant
Identity and control-plane logs for a Microsoft tenant.
- Host type
- Azure (platform and Entra ID)
- Standards scope
- cloud
- Minimum events
- 0
- Recommended events
- 39
- Log sources
- 7
Logs, as a whole
For this role the log is the unit an organization turns on, so each log is tiered as a whole, beside the per-event rows.
| Log | Tier | Techniques | Rules |
|---|---|---|---|
| Azure Activity Log (control plane) | Minimum | 9 | 122 |
| Entra ID audit logs | Minimum | 12 | 218 |
| Entra Privileged Identity Management logs | Recommended | 0 | 7 |
| Azure resource/platform logs (diagnostic settings) | Recommended | 0 | 99 |
| Entra ID Protection risk detections | Recommended | 0 | 25 |
| Entra ID sign-in logs | Minimum | 38 | 147 |
Minimum
No event reaches the minimum bar for this role at the event level. The logs tiered as a whole, above, are the unit to read.
Recommended
39 more events meet one of the three criteria. Each source opens on its own.
Azure Activity Log (control plane)3 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| MICROSOFT.COMPUTE/VIRTUALMACHINES/DELETE | 1 | none | ||
| MICROSOFT.COMPUTE/VIRTUALMACHINES/WRITE | 1 | none | ||
| networkInsightsLogs | 1 | none |
Entra ID audit logs20 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| Add | 0 | Elastic 3 | ||
| Add app role assignment to service principal | 0 | Splunk 2, Microsoft Sentinel 5 | ||
| Add delegated permission grant | 0 | Microsoft Sentinel 5 | ||
| Add member to role | 0 | Splunk 5, Microsoft Sentinel 3 | ||
| Add OAuth2PermissionGrant | 0 | Microsoft Sentinel 3 | ||
| Add service principal | 0 | Splunk 3, Microsoft Sentinel 3 | ||
| Add unverified domain | 0 | Splunk 1, Microsoft Sentinel 2 | ||
| Add user | 0 | Microsoft Sentinel 4 | ||
| application | 0 | Elastic 3 | ||
| Consent to application | 0 | Splunk 3, Microsoft Sentinel 6 | ||
| Delete user | 0 | Microsoft Sentinel 3 | ||
| device | 0 | Elastic 5 | ||
| Invite external user | 0 | Splunk 1, Microsoft Sentinel 4 | ||
| Register | 0 | Elastic 3 | ||
| Set domain authentication | 0 | Splunk 1, Microsoft Sentinel 3 | ||
| Set federation settings on domain | 0 | Microsoft Sentinel 3 | ||
| SignInEvents | 1 | none | ||
| Update application | 0 | Splunk 2, Microsoft Sentinel 1 | ||
| Update conditional access policy | 0 | Microsoft Sentinel 6 | ||
| Update user | 0 | Splunk 3, Microsoft Sentinel 4 |
Azure resource/platform logs (diagnostic settings)2 events · Usage billed
Entra ID sign-in logs14 events · Included
| Event | How to enable | Techniques | Rules | Standards |
|---|---|---|---|---|
| activity | 0 | Elastic 7 | ||
| ConditionalAccessPolicyEvaluated | 1 | none | ||
| InteractiveUser | 1 | none | ||
| NonInteractiveUser | 1 | none | ||
| RefreshTokenUsed | 1 | none | ||
| ServicePrincipalSignIn | 1 | none | ||
| Sign-in | 0 | Elastic 7 | ||
| SigninSuccess | 1 | none | ||
| TokenIssuanceStart | 1 | none | ||
| TokenIssuanceSuccess | 1 | none | ||
| TokenIssued | 1 | none | ||
| UserLoggedIn | 2 | none | ||
| UserLogin | 2 | none | ||
| UserLoginSuccess | 1 | none |