The goal is to get Entra logs into Splunk Cloud and alert on non-domain affiliated logins. Can't seem to find any documentation on.
You probably want the Splunk Add on for Microsoft Azure (https://splunkbase.splunk.com/app/3757)
There are set-up instructions described at https://github.com/splunk/splunk-add-on-microsoft-azure/wiki (see the sections on Configuration) on the right.
