↳ GitHub sourceWorkbook

Microsoft Entra ID Audit logs

Description

Gain insights into Microsoft Entra ID by connecting Microsoft Sentinel and using the audit logs to gather insights around Microsoft Entra ID scenarios. You can learn about user operations, including password and group management, device activities, and top active users and apps.

Version: 1.2.0
Declared author / publisher: Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AzureActiveDirectory

Data types

AuditLogs

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Workbooks/AzureActiveDirectoryAuditLogs.json ↗
Commit: 9800e51 ↗
Source identifier: AzureActiveDirectoryAuditLogsWorkbook

Additional source files 2

Workbooks/AzureActiveDirectoryAuditLogs.jsonsource ↗Workbooks/WorkbooksMetadata.jsonworkbook-metadata ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.