5.4.1. Logs and Diagnostic Settings
💡 First Principle: Choosing the right log is diagnosis; choosing the right destination is economics. The three logs partition by event type — authentication, directory change, provisioning — and the three destinations partition by use case — query, archive, stream.
| Sign-in logs | Audit logs | Provisioning logs | |
|---|---|---|---|
| Records | Authentication events: who, from where, which app, CA results, MFA detail, risk | Directory changes: user created, role assigned, group edited, consent granted, PIM actions | Provisioning engine ops: SCIM to SaaS, HR-driven, cross-tenant sync |
| Answers | "Why was Maria blocked?" "Which sign-ins came from Tor?" | "Who added Bob to Global Admins?" "Who consented to PDF Helper?" | "Why didn't Jane's account appear in ServiceNow?" |
| Flavors | Interactive, non-interactive, service principal, managed identity | — | Per-app provisioning detail |
Sign-in log literacy the exam checks: each entry carries the Conditional Access tab (per-policy result), authentication details (methods, MFA satisfaction), location/IP/device, and correlation IDs; non-interactive and service principal sign-ins are separate tabs — workload identity investigations (4.1) look there, not in the interactive list.
Diagnostic settings (Entra ID → Diagnostic settings) export any log category to: a Log Analytics workspace — the query and alert destination (KQL, workbooks, alert rules; feeds Microsoft Sentinel); a storage account — the cheap long-term archive destination (immutable retention policies for compliance years); an Event Hub — the stream to external systems destination (Splunk, QRadar, third-party SIEM). Multiple destinations can coexist in one setting. Map requirement verbs to destinations: "analyze/alert/workbook" → Log Analytics; "retain N years at lowest cost" → storage; "integrate with our non-Microsoft SIEM" → Event Hub.
⚠️ Exam Trap: "Send Entra logs to Splunk" is Event Hub, not Log Analytics — and "retain sign-in logs for 2 years cheaply" is a storage account, not extending portal retention (you can't). The destination is the answer; the log category is the second blank.
Reflection Question: For each question, name log + destination + why: (a) prove for auditors who held Global Admin during Q1, kept for 3 years; (b) alert within minutes when the break-glass account signs in; (c) feed all identity telemetry to the SOC's QRadar.
