'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Resolve Entra ID License Requirements for Exporting Sign-In Logs
Question details
The user is attempting to export Entra ID sign-in logs to an external SIEM and Event Hubs but receives an error stating an Entra ID P1 or P2 license is required. They need clarification on whether the license is required per tenant or per user.
- Product
- Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Exporting identity and sign-in logs to an external SIEM from an organization currently utilizing the Entra ID Free tier.
- Observed behavior
- Azure Audit Logs export successfully, but Entra ID sign-in logs fail to export because the system enforces an Entra ID P1 or P2 license requirement.
Ensure you have global administrator or billing administrator privileges in the Microsoft Entra admin center so you can view your current directory licenses and diagnostic settings.
Consult Microsoft Licensing Specialists via Learn Q&A
Because enterprise licensing terms for tenant-wide features frequently evolve, it is highly recommended to get official compliance confirmation directly from Microsoft.
While a single P1 or P2 license may technically unlock the export feature at the tenant level, Microsoft's compliance terms typically dictate how many user licenses are legally required. Specialized Microsoft representatives can provide the exact requirements for your specific SIEM integration scenario.
Open your web browser and go to the official Microsoft Learn Q&A platform.
Use the search bar to find and select the 'Microsoft Entra ID' tag so your post reaches the correct department.
Click 'Ask a question' and explain that you are currently on Entra ID Free. Specifically ask whether exporting sign-in logs requires a P1/P2 license for every single user in the tenant or if a single license covers the export capability.
Wait for a verified Microsoft employee or licensing specialist to respond with the definitive compliance guidelines.
Verify Current Entra ID Licensing and Activate a Trial
Check your existing license tier in the Entra portal and temporarily activate a premium trial to immediately unblock your SIEM log export.
Simplify Your Workflow with WPS Office
Managing complex Microsoft enterprise cloud infrastructure and per-user licensing for services like Entra ID can be overwhelming. Fortunately, handling your daily documents doesn't have to be. WPS Office offers a powerful, lightweight, and cost-free alternative to Microsoft Office, freeing you from complicated subscription tiers.
- 1. Visit the official website: Go to the official WPS Office website on your browser.
- 2. Download the software: Click the 'Free Download' button to get the installer for your operating system.
- 3. Install and launch: Run the installer, follow the prompts, and instantly open your existing Office files without complex license assignments.
Frequently Asked Questions
Why can I export Azure Audit Logs but not Entra ID sign-in logs on a Free tier?
Azure Audit Logs track subscription-level resource modifications and are included in free tiers. Entra ID sign-in logs, however, track detailed user identity and authentication events, which Microsoft categorizes as a premium identity security feature requiring Entra ID P1 or P2 licenses.
Does purchasing one P1 license unlock sign-in logs export for the whole tenant?
From a technical standpoint, adding a single P1 or P2 license to a tenant often unlocks the diagnostic settings UI to export logs. However, under Microsoft's licensing terms, you are legally required to have a license for every user whose sign-in data is being processed, exported, or analyzed.
How do I configure the export of Entra ID logs once licensed?
After acquiring the appropriate licenses, go to the Microsoft Entra admin center, navigate to 'Identity' > 'Monitoring & health' > 'Diagnostic settings', and click 'Add diagnostic setting'. From there, select 'SignInLogs' and choose your destination, such as an Event Hub or a specific SIEM integration.
