Configure an HTTP source, as described on HTTP Logs and Metrics Source.Ĭonfigure Azure Resources using ARM template .If desired, create a new Hosted Collector, as described on Configure a Hosted Collector. Select a Hosted Collector where you want to configure the HTTP Source.In this step, you configure an HTTP Source to receive logs from the Azure function. The sections below are either for FedRamp Sumo Logic deployments or if you have been advised by the Sumo Logic support team to not use the Cloud to Cloud Integration based on your Azure environments. This section has instructions for setting up the ingestion pipeline from Azure Active Directory to Sumo Logic.

Collecting Logs for Azure Active Directory Only global administrators, security administrators, security readers, and report readers can view sign-ins and enable collection for Sign-in Events. To export Azure Activity logs to reports, be sure you have met the Azure Active Directory requirements.For more information, see this Azure Active Directory documentation. An Azure subscription must be associated (attached) to AAD.The function also logs to one Storage Account and logs failover data to another. The Azure function is a small piece of code that is triggered by Event Hub to send Azure Active Directory logs to the Sumo HTTP Source.Event Hub streams the logs collected by Azure Monitor to an Azure function.Azure Monitor collects logs for Azure Active Directory and streams the data to an Azure Event Hub.The dashboards provide insight into role management, user management, group management, successful and failed sign-in events, directory management, and application management data that helps you understand your users' experience. The Sumo Logic App for Azure helps you monitor activity in the Azure Active Directory. Azure Active Directory is a cloud-based directory and identity management service that provides directory services, application access management, and identity protection.

Azure ad log