How do I get Entra logs (formerly Active directory), into Splunk Cloud?

[MelV]

The goal is to get Entra logs into Splunk Cloud and alert on non-domain affiliated logins. Can't seem to find any documentation on.

[marnall]

You probably want the Splunk Add on for Microsoft Azure (https://splunkbase.splunk.com/app/3757)

There are set-up instructions described at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki (see the sections on Configuration) on the right.