Collect Logs for the Azure Active Directory App

This section has instructions for setting up the ingestion pipeline from Azure Active Directory to Sumo Logic.

Solution Overview

Azure Monitor collects logs for Azure Active Directory and streams the data to an Azure Event Hub.
Event Hub streams the logs collected by Azure Monitor to an Azure function.
The Azure function is a small piece of code that is triggered by Event Hub to send Azure Active Directory logs to the Sumo HTTP Source. The function also logs to one Storage Account and logs failover data to another.

An Azure subscription must be associated (attached) to AAD. For more information, see this Azure Active Directory documentation.
To export Azure Active logs to reports, be sure you have met the Azure Active Directory requirements.

In this step, you configure an HTTP Source to receive logs from the Azure function.

Select a Hosted Collector where you want to configure the HTTP Source. If desired, create a new Hosted Collector, as described on Configure a Hosted Collector.
Configure an HTTP source, as described on HTTP Logs and Metrics Source.

To deploy a Sumo provided ARM template, follow the instructions in Step 2 for Collecting logs from Azure monitor.

To push Azure Active Directory logs to Event Hub, follow the below steps:

Login into Azure Portal.
Go to Azure Active Directory.
Go to Monitoring > Audit Logs.
Click Export Data Settings.
Diagnostic Settings blade will show all your existing settings if any already exist. Click Edit Setting if you want to change your existing settings, or click Add diagnostic setting to add a new one. Check the Stream to an event hub box Select an Azure subscription.
Select the Event Hubs namespace you created in Step 2. It should start with “SumoAzureLogsNamespace<UniqueSuffix>”.
Select insights-operational-logs from the Select event hub name dropdown.
Select RootManageSharedAccessKey from Select event hub policy name dropdown.
Check the box for log types under Category Details which you want to ingest.
Click Save.

If logs are not flowing into Sumo Logic, follow the steps in Troubleshooting log collection in the following document.