Microsoft Security | Microsoft Entra | Microsoft Entra ID
A cloud-based identity and access management service for securing user authentication and resource access
Entra ID Diagnostic Logs not arriving in Log Analytics / Sentinel (All settings verified)
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 12%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
용현 정
105
Reputation points
Hello,
I’m experiencing an issue where Microsoft Entra ID diagnostic logs are not being ingested into Log Analytics / Microsoft Sentinel, even though all configurations appear to be correct.
Environment
- Microsoft Sentinel enabled on Log Analytics Workspace
Entra ID diagnostic settings configured to send logs to the same workspace
Logs enabled:
AuditLogs
SignInLogs
Workspace ingestion is working (other data types are being ingested normally)
What I have verified
Diagnostic settings are configured under Entra ID (tenant level), not subscription or management group
The destination Log Analytics Workspace is the same one connected to Sentinel
Required permissions were used (Global Administrator / Log Analytics Contributor)
Diagnostic settings were deleted and recreated
Multiple sign-in events (successful and failed) were generated for testing
Waited more than 24 hours after configuration
Issue
SigninLogs and AuditLogs tables remain empty
Other tables in the workspace are receiving data normally
No errors are shown in the portal
Question
Is this a known issue or backend ingestion problem with Entra ID diagnostic logs?
I’ve seen similar reports where logs were delayed for many hours/days or required Microsoft backend intervention, but I’m unable to open a paid support ticket at this time.
If anyone has encountered this recently or knows of a workaround, I’d really appreciate any guidance.
Thank you.Hello,
I’m experiencing an issue where Microsoft Entra ID diagnostic logs are not being ingested into Log Analytics / Microsoft Sentinel, even though all configurations appear to be correct.
Environment
Microsoft Sentinel enabled on Log Analytics Workspace
Entra ID diagnostic settings configured to send logs to the same workspace
Logs enabled:
AuditLogs
SignInLogs
Workspace ingestion is working (other data types are being ingested normally)
What I have verified
Diagnostic settings are configured under Entra ID (tenant level), not subscription or management group
The destination Log Analytics Workspace is the same one connected to Sentinel
Required permissions were used (Global Administrator / Log Analytics Contributor)
Diagnostic settings were deleted and recreated
Multiple sign-in events (successful and failed) were generated for testing
Waited more than 24 hours after configuration
Issue
SigninLogs and AuditLogs tables remain empty
Other tables in the workspace are receiving data normally
No errors are shown in the portal
Question
Is this a known issue or backend ingestion problem with Entra ID diagnostic logs?
I’ve seen similar reports where logs were delayed for many hours/days or required Microsoft backend intervention, but I’m unable to open a paid support ticket at this time.
If anyone has encountered this recently or knows of a workaround, I’d really appreciate any guidance.
Thank you.
Microsoft Security | Microsoft Entra | Microsoft Entra ID
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous2026-01-28T06:59:03.78+00:00 Hello **용현 정,
**
We are looking into this issue and will keep you posted updates.Thanks,
Srisaisunder.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 10%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESS%3C/text%3E%3C/svg%3E)
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator2026-01-28T07:46:06.69+00:00 Hello 용현 정
Thank you for reaching out to Microsoft Q&A.Below are the resolution steps: -
1.) Ingestion Is Asynchronous and Not SLA‑Guaranteed
Microsoft explicitly states that Entra ID diagnostic log streaming does not guarantee immediate or continuous delivery and may experience delays without surfacing errors in the portal.
Diagnostic settings may show as “configured successfully” even when backend ingestion is delayed or impaired.
For your reference: https://docs.azure.cn/en-us/entra/identity/monitoring-health/concept-log-monitoring-integration-options-considerations
- Force a Backend Re‑Provision (Only Reliable Workaround)
Microsoft engineers often recommend the following reset pattern, which works in many cases:
- Delete ALL Entra ID diagnostic settings
- Wait at least 1 hour (important – documented ingestion cache)
- Recreate diagnostic settings with:
- Only ONE log type enabled initially (
SigninLogs)
- Only ONE log type enabled initially (
- Confirm data arrival
- Re‑enable
AuditLogsafterward
For your reference: https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-configure-diagnostic-settings
2.) Verify License Eligibility
Microsoft explicitly requires:
Log Type Required License SigninLogsEntra ID P1 or P2 AuditLogsAny Entra license If SigninLogs never arrive, but AuditLogs later do, license enforcement may be happening silently.
For your reference: https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory
- Temporary Alternate Access (While waiting)
While ingestion is broken, Microsoft recommends:
- Querying logs via Microsoft Entra admin center
- Export via Microsoft Graph API
- Temporary storage export to Azure Storage Account
For your reference: https://docs.azure.cn/en-us/entra/identity/monitoring-health/concept-log-monitoring-integration-options-considerations
References:
-
Shubham Sharma 17,930 Reputation points Microsoft External Staff Moderator
2026-01-29T08:31:31.45+00:00 Hello 용현 정
Following up to check if the resolution provided above was helpful. Please let us know if you need any further assistance.
Sign in to comment
Sign in to answer