According to Microsoft Entra (formerly Azure Active Directory) and Microsoft Security Operations documentation, when integrating Azure AD sign-in logs and audit logs with third-party SIEM systems , the supported and recommended method is to stream the logs to Azure Event Hubs through Diagnostic Settings .
Event Hubs act as a real-time data ingestion service that can integrate directly with external SIEM tools such as Splunk, QRadar, ArcSight, or Sumo Logic. This allows for near real-time alerting and analysis of Azure AD sign-in events.
Official Microsoft guidance states:
"To integrate Azure AD logs with third-party SIEMs, configure Azure AD Diagnostic Settings to send sign-in and audit logs to Azure Event Hubs. Event Hubs can then stream the data to your SIEM for near real-time monitoring." Other options do not meet the scenario's requirement:
* (A) and (C) involve Azure Sentinel, Microsoft's native SIEM solution. Since the question specifies a third-party SIEM , Sentinel is not required.
* (D) Archiving to a Storage account provides long-term retention and offline analysis but does not support near real-time alerting.
Therefore, the correct approach to route Azure AD sign-in events for near real-time monitoring in a third- party SIEM is to configure Azure AD Diagnostic Settings to stream logs to an Azure Event Hub .
# Correct Answer: B. Configure the Diagnostics settings in Azure AD to stream to an event hub