# Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting

A Microsoft Entra diagnostic setting sends the sign-in, audit and risk logs to a Log Analytics workspace or another log store.

Source: https://maester.dev/docs/tests/DISA.V-270227

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · Logs and monitoring · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-270227
```

## Overview

A Microsoft Entra diagnostic setting sends the sign-in, audit and risk logs to a Log Analytics workspace or another log store. (DISA Microsoft Entra ID STIG, V-270227, CAT II).

Sign-in and audit logs kept only in Microsoft Entra ID are retained for 30 days at most and are not correlated with other sources. Sending them to a SIEM keeps them and lets the security team alert on them.

This test runs the same check as [CISA.MS.AAD.4.1](https://maester.dev/docs/tests/CISA.MS.AAD.4.1) with DISA's list of categories (`RequiredLogCategory`): SignInLogs, AuditLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs, UserRiskEvents, RiskyUsers, RiskyServicePrincipals and ServicePrincipalRiskEvents. CISA asks for four more. The STIG also asks you to confirm in Microsoft Sentinel, or your SIEM, that logs arrived within the last hour; check that by hand.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **Monitoring & health** > **[Diagnostic settings](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/DiagnosticSettingsMenuBlade/~/General)**.
2. Select **Add diagnostic setting**, or **Edit setting** on an existing one.
3. Select the eight log categories listed above and send them to a Log Analytics workspace (or another destination your SIEM reads).
4. Select **Save**.

#### Related links

* [DISA Microsoft Entra ID STIG: V-270227](https://cyber.trackr.live/stig/Entra_ID/1/2/V-270227)
* [Configure Microsoft Entra diagnostic settings for activity logs](https://learn.microsoft.com/entra/identity/monitoring-health/howto-configure-diagnostic-settings)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-270227 |
| Severity | High |
| Suite | DISA |
| Product | Entra ID |
| Feature | Logs and monitoring |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270227 |
| Supports controls | disa-stig-entra-id:V-270227, nist-800-53-r5:AU-4(1), nist-800-53-r5:AU-9(2) |
| PowerShell test | [Test-MtDisaEntraLogExport](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270227.ps1) |
| Services | Graph, Azure |
| Compatible licenses | AAD_PREMIUM |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-270227.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270227.ps1)
- Documentation: [`tests/disa/Test.DISA.V-270227.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270227.md)