Azure Sign In logs in Real Time

[quantrium-anant]

Hello

I am new to Splunk.

I wish to use the sign in information from Azure AD/Entra ID. Is there a way to get these logs (sign-in logs) in real-time? Or probably even the syslog for sign-in activity?

I have been through Microsoft Log Analytics Workspace, it suggests latency for the same to be 20 sec to 3 min. Is there a way to reduce this?

Is a documentation supporting confirming the latency limits?

[isoutamo · Accepted solution]

Hi

have you try this https://splunkbase.splunk.com/app/3757 ?

Of course if the issue is that Azure has this internal delays there is nothing that could fixed by integrations. If this is the issue, then you should contact to Azure support and ask from them if there are any workarounds for it.

r. Ismo

[quantrium-anant]

Thank you @isoutamo for your reply.

I will look into the tool.