Panther supports ingesting Microsoft Entra ID (previously "Azure Active Directory") Audit logs via common options, like Azure Blob storage.
How to onboard Microsoft Entra ID Audit logs to Panther
You'll first create an Azure Blob Storage source in Panther, then configure Azure to export logs to that location.
Step 1: Create the Microsoft Entra ID source in Panther
In the lefthand navigation bar of your Panther Console, click Configure > Log Sources.
Click Create New.
Search for “Microsoft Entra ID Audit” then click its tile.
In the slide-out panel, the Transport Mechanism dropdown in the upper-right corner will be pre-populated with the Azure Blob Storage option.
Click Start Setup.
Follow Panther's instructions for configuring an .
If during you choose to create your Azure resources manually (instead of using Terraform), skip , as one will automatically be created in your storage account in Step 2, below.
Step 2: Export Microsoft Entra ID Audit logs to Azure Blob storage
To export Microsoft Entra ID Audit logs to a Blob storage container:
Sign in to your Azure dashboard.
Navigate to the Microsoft Entra ID service.
In the left-hand panel, click Audit logs.
Click Add Diagnostic Setting.
On the Diagnostic setting page, set the following values:
Diagnostic setting name: Enter a descriptive name.
Categories (under Logs): Select the following checkboxes:
AuditLogs
SignInLogs
NonInteractiveUserSignInLogs
ServicePrincipalSignInLogs
ManagedIdentitySignInLogs
Destination details: Select the Archive to a storage account checkbox, then select your destination Storage account.
In the upper left corner, click Save.
Audit and sign-in logs will now be saved to a Blob container in your storage account.
Step 3: Add role assignment to container
Click on your newly created container, then in the left-hand navigation bar, click Access Control (IAM).
Click Add Role Assignment.
Click on the Members tab.
Click +Select Members.
Click Review+Assign.
Panther-managed detections
Supported log types
Azure.Audit
The Azure.Audit log schema covers Microsoft Entra ID audit logs and sign-in logs. For more information, see the Microsoft documentation:
