topic Re: Azure Sign In logs in Real Time in Getting Data In

Azure Sign In logs in Real Time

quantrium-anant — Thu, 08 Aug 2024 05:50:55 GMT

Hello

I am new to Splunk.

I wish to use the sign in information from Azure AD/Entra ID. Is there a way to get these logs (sign-in logs) in real-time? Or probably even the syslog for sign-in activity?

I have been through Microsoft Log Analytics Workspace, it suggests latency for the same to be 20 sec to 3 min. Is there a way to reduce this?

Is a documentation supporting confirming the latency limits?

Re: Azure Sign In logs in Real Time

isoutamo — Thu, 08 Aug 2024 16:55:57 GMT

have you try this https://splunkbase.splunk.com/app/3757 ?

Of course if the issue is that Azure has this internal delays there is nothing that could fixed by integrations. If this is the issue, then you should contact to Azure support and ask from them if there are any workarounds for it.