Skip to content

Commit

Permalink
Docs8718/update azure ad (#18423)
Browse files Browse the repository at this point in the history
* (DOCS-8718) Rename Azure AD

* (DOCS-8718) Replace Azure AD

* Update link

* Update link

* Update README.md

* (DOCS-8718) Update integration ID

* (DOCS-8718) Restore app_id value

* (DOCS-8718) Revert folder name change

* (DOCS-8718) Revert source_type_name change
  • Loading branch information
buraizu authored Nov 26, 2024
1 parent c82a811 commit 74defa8
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 17 deletions.
28 changes: 13 additions & 15 deletions azure_active_directory/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,40 +2,38 @@

## Overview

Azure Active Directory is a cloud hosted Active Directory offering by Microsoft Azure.
This integration allows you to ingest your [Azure AD activity logs][1] (audit and sign-in logs) to Datadog.
Microsoft Entra ID is a cloud-hosted identity and access management service that enables users to access external resources.
This integration allows you to forward your [Microsoft Entra ID][1] audit and sign-in logs to Datadog.

## Setup

### Installation

This integration forwards logs to Datadog using Azure with Event Hubs. Configure Azure AD to forward activity logs to the event hub.
This integration forwards logs to Datadog using Azure with Event Hubs. Configure Entra ID to forward activity logs to the event hub.

### Configuration

1. Set up the log forwarding pipeline from Azure to Datadog using Event Hubs by following the [Send Azure Logs to Datadog][2] guide.

2. In Azure portal, select _Azure Active Directory > Monitoring > Audit logs_.
2. In Azure portal, select _Microsoft Entra ID > Monitoring > Audit logs_.

3. Select **Export Settings**.
3. Select **Export Data Settings**.

4. In the Diagnostics settings pane, do one of the following:

- To change existing settings, select **Edit setting**.
- To add new settings, select **Add diagnostics setting**. You can have up to three settings.

5. Select the **Stream to an event hub** check box, and then select **Event Hub/Configure**.
5. Select the **Stream to an event hub** check box.

6. Select the Azure subscription and Event Hubs namespace that you created earlier to route the logs to.

7. Select OK to exit the event hub configuration.

8. Do one or both of the following. Datadog recommends selecting both.
7. Do one or both of the following. Datadog recommends selecting both.

- To send audit logs, select the **AuditLogs** check box.
- To send sign-in logs, select the **SignInLogs** check box.

9. Select **Save**.
8. Select **Save**.

Logs should start coming into Datadog within 15 minutes.
For more details on the setup, see the [Azure tutorial][3].
Expand All @@ -44,7 +42,7 @@ For more details on the setup, see the [Azure tutorial][3].

#### Log collection

This integration allows you to setup log ingestion for Azure Active Directory activity logs.
This integration allows you to setup log ingestion for Microsoft Entra ID activity logs.

This includes the following:

Expand All @@ -54,11 +52,11 @@ This includes the following:

### Metrics

Azure Active Directory does not include any metrics.
Microsoft Entra ID does not include any metrics.

### Events

Datadog sends credential expiry events, which grant visibility into credential expirations for Azure app registrations, Key Vault keys, Key Vault secrets, and Key Vault certificates. The Azure Active Directory integration must be installed to receive events for Azure app registrations. Receiving events from Azure also requires installation of the [Azure integration][7].
Datadog sends credential expiry events, which grant visibility into credential expirations for Azure app registrations, Key Vault keys, Key Vault secrets, and Key Vault certificates. The Microsoft Entra ID integration must be installed to receive events for Azure app registrations. Receiving events from Azure also requires installation of the [Azure integration][7].


- **Expiration events** are sent 60, 30, 15, and 1 day(s) before credential expiration, and once after expiration.
Expand All @@ -75,9 +73,9 @@ You can view these events in [Event Explorer][5].

Need help? Contact [Datadog support][4].

[1]: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/overview-reports#activity-reports
[1]: https://learn.microsoft.com/entra/identity/monitoring-health/overview-monitoring-health
[2]: https://docs.datadoghq.com/logs/guide/azure-logging-guide/
[3]: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-azure-monitor-stream-logs-to-event-hub
[3]: https://learn.microsoft.com/entra/identity/monitoring-health/howto-stream-logs-to-event-hub
[4]: https://docs.datadoghq.com/help
[5]: https://app.datadoghq.com/event/explorer
[6]: https://docs.datadoghq.com/integrations/guide/azure-graph-api-permissions/
Expand Down
4 changes: 2 additions & 2 deletions azure_active_directory/manifest.json
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@
"configuration": "README.md#Setup",
"support": "README.md#Support",
"changelog": "CHANGELOG.md",
"description": "Analyze your Azure Active Directory activity logs",
"title": "Azure Active Directory",
"description": "Analyze your Microsoft Entra ID activity logs",
"title": "Microsoft Entra ID",
"media": [],
"classifier_tags": [
"Category::Azure",
Expand Down

0 comments on commit 74defa8

Please sign in to comment.