Forward Microsoft 365 security logs to the SIEM or SOC

Description

The following logs are collected continuously, close to real time, by the organization's SIEM or SOC platform (Microsoft Sentinel or another product):

• Microsoft Entra ID: sign-in logs (interactive, non-interactive, service principal, managed identity), audit logs, provisioning logs, risky users and risk detections, through Diagnostic settings to a Log Analytics workspace, an event hub or a partner solution;
• Microsoft 365 unified audit log (Exchange, SharePoint, OneDrive, Teams, Power Platform, Copilot), through the Office 365 Management Activity API or the Microsoft 365 connector;
• Microsoft Defender XDR incidents, alerts and advanced hunting events, through the streaming API or the Defender XDR connector;
• Microsoft Intune audit and operational logs, through Intune Diagnostic settings.

The collection chain is monitored: an alert is raised when a source stops sending events, and its coverage is reviewed at least once a year.

Diagnostic settings and Management Activity API subscriptions are not exposed through Microsoft Graph: the evidence is a screenshot or export of the configuration and a query in the SIEM.

Rationale

Native consoles keep logs for a limited time and do not correlate Microsoft 365 events with on-premises, network and endpoint signals. Central collection lets the SOC detect an attack that starts with a phished account and continues on the network, keeps evidence out of reach of a tenant administrator who would tamper with it, and supports the retention requirements of CB-M365-AUDIT-003. Monitoring the chain detects a disabled export, a frequent attacker move.

Impact

Log Analytics, event hub or SIEM ingestion has a cost proportional to volume (non-interactive sign-ins and audit logs are large). Diagnostic settings require an Azure subscription.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader and browse to Entra ID > Monitoring & health > Diagnostic settings. Check that a setting sends at least AuditLogs, SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs, ProvisioningLogs, RiskyUsers and UserRiskEvents to the SIEM destination.
2. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a Read Only Operator and browse to Reports > Diagnostic settings; check that AuditLogs and OperationalLogs are sent.
3. In the SIEM, check that the Microsoft 365 (Office 365) and Microsoft Defender XDR connectors or the Management Activity API and streaming API subscriptions are active, and run a query that returns events from each source for the last hour.
4. Ask the SOC for the alert rule that detects a silent source and for the last coverage review.
5. Fail if one of the four sources is not collected, if collection is delayed by more than a few hours, or if no alert detects a source that stops.

Remediation

1. Prepare the destination (Log Analytics workspace for Microsoft Sentinel, event hub for a third-party SIEM).
2. In the Microsoft Entra admin center as a Security Administrator, browse to Entra ID > Monitoring & health > Diagnostic settings > Add diagnostic setting, select the log categories listed above and the destination, and save.
3. In the Microsoft Intune admin center as an Intune Administrator, browse to Reports > Diagnostic settings > Add diagnostic setting, select AuditLogs, OperationalLogs, DeviceComplianceOrg and Devices, and save.
4. In the SIEM, enable the Microsoft 365 and Microsoft Defender XDR connectors (or subscribe to the Office 365 Management Activity API content types Audit.AzureActiveDirectory, Audit.Exchange, Audit.SharePoint, Audit.General, DLP.All, and configure the Defender XDR streaming API).
5. Create an alert rule for each source that raises an incident when no event arrives for a defined period.

Rollback

Delete the diagnostic setting or disable the connector.

References

• Configure Microsoft Entra diagnostic settings for activity logs Microsoft, vendor-doc, accessed 2026-10-24
• Office 365 Management Activity API reference Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft Defender XDR streaming API Microsoft, vendor-doc, accessed 2026-10-24
• Send Intune log data to Azure Monitor Microsoft, vendor-doc, accessed 2026-10-24
• Recommandations de sécurité pour l'architecture d'un système de journalisation ANSSI, guide, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• requires CB-M365-AUDIT-001 Turn on the unified audit log
• related CB-M365-AUDIT-003 Retain Microsoft 365 audit logs long enough for investigations
• related CB-M365-AUDIT-008 Turn on key Microsoft 365 alert policies and route them to a monitored destination
• related CB-M365-AUDIT-009 Alert on every use of emergency access accounts
• related CB-M365-AUDIT-010 Notify administrators when high-risk users are detected
• related CB-M365-ADMIN-009 Alert on assignment and activation of highly privileged roles
• related CB-M365-MAIL-034 Turn on automated remediation of malicious message clusters in AIR

People and lifecycle