This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(76.8, 68%, 17%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJR%3C/text%3E%3C/svg%3E)
Hello Microsoft Team,
We have configured Azure Audit Logs and Sign-in Logs from Active Directory to be pushed to Event Hub using diagnostic settings. From this Event Hub, the logs are being exported to an external SIEM, utilizing SAS Policy keys.
Currently, Audit Logs are successfully being pushed to the Event Hub. However, Sign-in Logs are not being transmitted due to a licensing issue. The system indicates that an Entra ID P1 or P2 license is required for our organization.
We would like clarification on the licensing requirement. Specifically, does our organization need only one P1 or P2 license for entire organisation for this functionality, or does each user require an individual P1 or P2 license for sign-in logs to be exported?
For your reference, we are currently using the Entra ID Free license.
Looking forward to your guidance on this.
A cloud-based identity and access management service for securing user authentication and resource access
Licensing is assigned to the user not the tenant, so to be compliant, you would need a premium license for each user you want to export the sign in logs for.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(35.2, 30%, 13%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGP%3C/text%3E%3C/svg%3E)
Hello Jeevan Reddy Palla ,
I Understand you want to transmit the sign in logs to the event hub but the system indicates that an Entra ID P1 or P2 license is required for your organization.
I hope Andy David - MVP answer is helpful.
The license you assign is for the user, not the entire tenant. Therefore, to export the sign-in logs, you need to assign the license individually to each user.
For Additional information you can refer the documents: P1 or P2 License , Microsoft Entra Licensing , Microsoft-Entra-Pricing
Let us know if you have any other queries happy to assist you further.
Please "Accept the answer" if the above information helped you. This will help us and others in the community as well.
Hello Jeevan Reddy Palla ,
Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Hello Jeevan Reddy Palla ,
Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(172.8, 6%, 26%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMH%3C/text%3E%3C/svg%3E)
How do we limit the export of logs to only the specific users? In the case of configuring a Sentinel Entra data connector, it seems like you can only turn on or off sign-in logs. Will it only export the appropriate logs based on licensed users?