EIDTNT-011: Diagnostic Settings for Audit and Sign-In Logs
- Platform
- Entra ID / M365
- Category
- Entra ID Tenant Configuration
- Severity
- High
- Zero Trust pillar
- Governance (weight 2)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Entra ID generates audit logs and sign-in logs that are critical for security monitoring, incident investigation, and compliance reporting. Without diagnostic settings configured to export these logs to a durable storage location such as a Log Analytics workspace, Azure Storage account, or SIEM, logs are retained for only a limited period within Entra ID and may be unavailable during incident investigation. Attackers actively target logging configuration to disable or evade detection.
Recommended value
All Entra ID log categories (audit, sign-in, non-interactive sign-in, service principal sign-in, managed identity sign-in, provisioning) exported to a Log Analytics workspace or SIEM
Remediation
Navigate to Entra ID > Monitoring > Diagnostic settings and create or verify a diagnostic setting that exports all log categories to a Log Analytics workspace, Azure Storage account, or Event Hub for SIEM ingestion. Ensure all available log categories are selected including audit logs, sign-in logs, non-interactive sign-in logs, service principal sign-in logs, managed identity sign-in logs, and provisioning logs. Verify that the destination storage has appropriate retention policies and access controls configured.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| always-warn | WARN |
Framework mappings
- CISA SCuBA
- MS.AAD.4.1v1
- NIST SP 800-53
- AU-2, AU-3, AU-6
- CIS M365 Benchmark
- 3.1
- MITRE ATT&CK
- T1562.008