Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Logs and monitoring · All checks

Run this check

Invoke-Maester -TestId DISA.V-270227

Overview

A Microsoft Entra diagnostic setting sends the sign-in, audit and risk logs to a Log Analytics workspace or another log store. (DISA Microsoft Entra ID STIG, V-270227, CAT II).

Sign-in and audit logs kept only in Microsoft Entra ID are retained for 30 days at most and are not correlated with other sources. Sending them to a SIEM keeps them and lets the security team alert on them.

This test runs the same check as CISA.MS.AAD.4.1 with DISA’s list of categories (RequiredLogCategory): SignInLogs, AuditLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs, UserRiskEvents, RiskyUsers, RiskyServicePrincipals and ServicePrincipalRiskEvents. CISA asks for four more. The STIG also asks you to confirm in Microsoft Sentinel, or your SIEM, that logs arrived within the last hour; check that by hand.

Remediation action

1. In the Microsoft Entra admin center, go to Entra ID > Monitoring & health > Diagnostic settings.
2. Select Add diagnostic setting, or Edit setting on an existing one.
3. Select the eight log categories listed above and send them to a Log Analytics workspace (or another destination your SIEM reads).
4. Select Save.

Related links

• DISA Microsoft Entra ID STIG: V-270227
• Configure Microsoft Entra diagnostic settings for activity logs

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-270227
Severity	High
Suite	DISA
Product	Entra ID
Feature	Logs and monitoring
Area	Logging and detection
Resource type	Tenant
User impact	Low
Implementation cost	Medium
MITRE ATT&CK	T1685.002 Disable or Modify Cloud Log
Supports benchmark	DISA Microsoft Entra ID STIG (version V1R2), requirement V-270227
Supports controls	disa-stig-entra-id:V-270227, nist-800-53-r5:AU-4(1), nist-800-53-r5:AU-9(2)
PowerShell test	Test-MtDisaEntraLogExport
Services	Graph, Azure
Compatible licenses	AAD_PREMIUM

Source

• Test: tests/disa/Test.DISA.V-270227.ps1
• Documentation: tests/disa/Test.DISA.V-270227.md