'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Send Azure PIM Logs to Microsoft Defender or Splunk
Question details
The user needs to know how to export Microsoft Entra Privileged Identity Management (PIM) audit logs to external security monitoring tools like Microsoft Defender and Splunk.
- Product
- Azure Privileged Identity Management (PIM)
- Device & OS
- not provided
- Scenario
- Configuring security monitoring and routing directory audit logs from Microsoft Entra ID to a centralized SIEM or workspace.
- Observed behavior
- The user requires guidance on the correct diagnostic settings, Log Analytics workspace integration, or Splunk connectors needed to successfully route PIM logs.
Ensure you have Global Administrator or Security Administrator privileges in your Microsoft Entra ID tenant to configure and modify diagnostic settings.
Configure Diagnostic Settings and Consult Microsoft Q&A
Since exporting Azure PIM logs requires specific Log Analytics or Event Hub configurations, utilizing Microsoft Entra ID Diagnostic Settings and the official Microsoft Q&A community is the best approach.
Exporting Azure PIM logs involves configuring Diagnostic Settings in Microsoft Entra ID. This routes directory audit data to a Log Analytics workspace for Microsoft Defender, or streams it to an Azure Event Hub for ingestion by Splunk.
Log in to the Azure Portal, navigate to 'Microsoft Entra ID', scroll down to the 'Monitoring' section on the left sidebar, and select 'Diagnostic settings'.
Click 'Add diagnostic setting'. Under the 'Categories' section, check the box for 'AuditLogs', as PIM activation events are recorded as directory audit logs.
For Microsoft Defender, select 'Send to Log Analytics workspace' and choose your integrated workspace. For Splunk, select 'Stream to an event hub' and select your configured Event Hub namespace.
If you encounter ingestion issues, post your specific architecture details on Microsoft Q&A under the 'Azure PIM' or 'Microsoft Entra ID' tags, where cloud specialists can provide custom deployment scripts.
Manage Your IT Documentation with WPS Office
While you handle complex Azure security integrations, you need a reliable suite to manage your IT documentation, audit reports, and deployment guides. WPS Office is a lightweight, free alternative to Microsoft Office that perfectly handles all your administrative document needs.
- 1. Download WPS Office: Visit the official WPS website and download the free installation package for your operating system.
- 2. Install and Open: Run the installer, follow the on-screen prompts, and open the application to access Writer, Spreadsheets, and Presentation tools.
- 3. Edit IT Documents: Open your existing Microsoft Office (.docx, .xlsx, .pptx) audit reports or network diagrams and start editing seamlessly.
Frequently Asked Questions
Can I send Azure PIM logs directly to Splunk without an Azure Event Hub?
No, typically Microsoft Entra ID audit logs must first be streamed to an Azure Event Hub. Splunk then reads these logs from the Event Hub using the Splunk Add-on for Microsoft Cloud Services.
Which specific log categories contain my PIM activation data?
You need to select the 'AuditLogs' category within the Diagnostic settings. Privileged Identity Management role activations and assignment changes are recorded as part of the directory audit logs.
Why are my PIM logs not appearing in Microsoft Defender?
Ensure that your Log Analytics workspace is correctly connected to Microsoft Defender for Cloud, and verify that you have granted the necessary permissions for Defender to ingest data from that specific workspace.
Do I need a premium Azure license to export PIM logs?
Yes, utilizing Azure PIM features requires Microsoft Entra ID P2 licenses. Additionally, exporting these logs to external workspaces or event hubs may incur Azure data ingestion and storage costs.
