Reference:
In the SC-300 exam domain "Monitor and maintain Azure AD", the official guidance specifies that to integrate Azure AD audit logs or sign-in logs with Azure Monitor (Log Analytics), you must first configure diagnostics settings in Azure AD.
The process is outlined as follows:
In the Azure portal, navigate to Azure Active Directory # Diagnostic settings.
Create a new diagnostic setting and select AuditLogs and/or SignInLogs.
Choose a destination, such as a Log Analytics workspace, Event Hub, or Storage account.
This configuration ensures that all audit log data is streamed into the selected Log Analytics workspace, where it can be queried using Kusto Query Language (KQL) and visualized with Azure Monitor Workbooks or Power BI.
The other options do not satisfy the prerequisite:
Set-AzureADTenantDetail modifies tenant properties, not log forwarding.
Creating a workbook allows visualization after data is available in Log Analytics.
Get-AzureADAuditDirectoryLogs retrieves logs directly via PowerShell but doesn't connect Azure AD to Azure Monitor.