According to the Microsoft Identity and Access Administrator (SC-300) Official Study Guide and Microsoft Learn module: "Monitor and troubleshoot Azure Active Directory", to integrate Azure Active Directory audit logs with Azure Monitor, Log Analytics, or Event Hubs, you must first configure Diagnostic settings in Azure AD.
Azure AD logs - including Audit Logs and Sign-in Logs - are stored natively within Azure AD for a limited retention period (14-30 days, depending on license). However, to analyze these logs over time, perform custom queries, or integrate them with monitoring or SIEM solutions, administrators must send them to Azure Monitor logs, Azure Storage, or Event Hubs.
The official documentation explicitly states:
"To send Azure AD logs to Azure Monitor, create a diagnostic setting in Azure Active Directory. From there, select which log categories (AuditLogs, SignInLogs, or NonInteractiveUserSignInLogs) you want to send to a Log Analytics workspace, Event Hub, or storage account." Steps outlined in the study guide and Microsoft Learn:
* Sign in to the Azure portal as a Global Administrator.
* Navigate to Azure Active Directory # Diagnostic settings.
* Select Add diagnostic setting.
* Choose the log categories (e.g., AuditLogs, SignInLogs).
* Select a destination - for instance, a Log Analytics workspace (for Azure Monitor integration).
This configuration is required before Azure Monitor can query or visualize Azure AD audit data.