GitHub Enterprise Audit Log (via Azure Storage)

Description

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

Read and Write permissions are required.

Workspace

Workspace

Microsoft Entra ID - Admin Consent (one-time per tenant)

The connector uses Microsoft's **ScubaSentinelToStorageProd** enterprise application to access your storage account. If this app has not been previously consented to in your tenant, a user with one of the following roles must click **'Grant tenant-wide admin consent'** on the connector page before proceeding:
- **Cloud Application Administrator** *(minimum required role)*
- **Application Administrator**
- **Global Administrator**

> **Note:** This is a one-time action per tenant. If the service principal already exists (i.e., another connector using ScubaSentinelToStorageProd was previously configured in this tenant), the service principal ID will be auto-populated and no action is needed.

Subscription permissions

You need the following permissions to deploy the connector's data flow resources:
- **Contributor** role on the subscription or resource group - to deploy Event Grid, storage queues, DCR, and related connector resources.
- **Owner** or **User Access Administrator** role on the Storage Account - to assign RBAC roles to the Microsoft Sentinel service principal.
- **Owner** or **Event Grid Contributor** role on the Storage Account - to create Event Grid system topics and event subscriptions.

> **Note:** The `Microsoft.EventGrid` resource provider must be [registered](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-providers-and-types) in the subscription containing the storage account.

Storage Account Requirements

The Azure Blob Storage account must meet the following requirements:
- **Azure Data Lake Storage Gen2 (hierarchical namespace enabled)** - standard storage accounts are not supported.
- A blob container already configured to receive GitHub Enterprise audit log streaming.

Storage Account Network Configuration

IP-based network rules (selected networks / IPv4 CIDR) are **not supported** for this connector due to [Azure Storage firewall restrictions and limitations](https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-limitations):
- IP network rules have **no effect** on requests originating from the same Azure region as the storage account.
- IP network rules **cannot restrict** access to Azure services deployed in the same region, as these services use private Azure IP addresses for communication.
- Virtual network service endpoint rules do not apply to clients in a paired region.

**Options:**
- **No network restrictions needed?** Set the storage account's **Networking** blade to **Enabled from all networks**.
- **Need to restrict access?** Use [Network Security Perimeter (NSP)](https://learn.microsoft.com/en-us/azure/sentinel/enable-storage-network-security) to whitelist Scuba IPv4 addresses. Note: only IPv4 addresses are currently supported for NSP inbound rules; IPv6 is not supported. There is an ongoing effort with the NSP team to support service tags, which will eliminate the need for manual IP management in the future.

**Important:** Do **not** configure network rules based on GitHub IP ranges. GitHub does not provide stable IP ranges as the source of audit log streaming, and those IPs may change without notice.

Storage Account Role Assignments

The following Azure RBAC roles must be assigned to the Microsoft Sentinel enterprise application service principal (displayed below) on the **Storage Account** that contains your blob container:
- **Storage Blob Data Reader** - required for reading blob data from the container.
- **Storage Queue Data Contributor** - required for managing notification and dead-letter queue messages.

To assign these roles: navigate to the Storage Account -> **Access Control (IAM)** -> **Add role assignment**, search for the service principal ID shown below, and assign both roles.

Collecting GitHub audit logs to your blob container

Follow the steps in the [GitHub documentation](https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-streaming-to-azure-blob-storage) to configure audit log streaming to your Azure Blob Storage container.

- When following the guidance to generate a SAS token, two signing methods are supported: **Account key** and **User delegation key**. 

For the **Account key** method, we recommend first creating a [Stored Access Policy](https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy) and then generating the SAS tied to that policy. 

Binding the SAS to a policy lets you change its expiry and permissions, or revoke it, on the server side. This enables seamless rotation by updating the policy rather than reissuing the token.

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Related content

Links established from declared identifiers and solution manifests.