How to stream Azure Activity logs into log analytic Workspace

cyber punk 20 Reputation points
2026-10-16T23:46:34.91+00:00

Hello Microsoft Community,

I am migrating Microsoft Sentinel from a source Azure tenant to a target Azure tenant and need clarification regarding the Azure Activity data connector.

In the source tenant, the Azure Activity connector is connected and actively ingesting data into the "AzureActivity" table. I also found that diagnostic settings are configured under Azure Monitor → Settings → Diagnostic settings in the source environment. However, no subscription-level diagnostic settings are visible under Azure Monitor → Activity Log → Export Activity Logs. The source Azure Activity connector appears to be using the legacy ingestion method.

In the target tenant, I configured the corresponding diagnostic settings to send logs to the target Log Analytics workspace. However, the Azure Activity connector is not appearing in Microsoft Sentinel, and the "AzureActivity" table is not visible in the target workspace.

I observed similar behavior when configuring Microsoft Entra ID diagnostic settings. After enabling diagnostic settings for Entra ID and selecting the target Log Analytics workspace, the Entra ID connector appeared automatically under Microsoft Sentinel Data connectors, and the logs started ingesting into the workspace.

Based on this observation, I expected the Azure Activity connector to behave similarly after configuring the relevant diagnostic settings. However, this has not happened.

Could you please clarify the following?

  1. Why did the Entra ID connector appear automatically and start ingesting logs after configuring diagnostic settings, while the Azure Activity connector did not?
  2. Are diagnostic settings configured under Azure Monitor → Settings → Diagnostic settings sufficient for Azure Activity log ingestion, or is subscription-level configuration under Activity Log → Export Activity Logs required?
  3. Is installing the Azure Activity solution from Content Hub and configuring the connector through the Azure Policy Assignment wizard required to use the diagnostic-settings-based ingestion pipeline?
  4. If diagnostic settings have already been configured manually for the target subscription, what additional steps are required to make the Azure Activity connector appear and start ingesting data?
  5. How can I verify whether the target subscription is successfully exporting Activity Log events to the intended Log Analytics workspace?

I would appreciate guidance on the recommended approach for migrating the Azure Activity connector from the legacy ingestion method to the diagnostic-settings-based pipeline.

Thank you.

Microsoft Security | Microsoft Sentinel

1 answer

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-16T23:47:04.83+00:00

    For Azure Activity in Microsoft Sentinel, the supported path in the provided guidance is the diagnostic settings pipeline that sends subscription activity logs to the Log Analytics workspace where Microsoft Sentinel is enabled.

    1. Why Entra ID appeared automatically but Azure Activity did not

    The available guidance only confirms the Azure Activity flow through subscription diagnostic settings and the Sentinel Azure Activity connector. It does not document Entra ID connector behavior, so the supported conclusion here is only that Azure Activity requires the Azure Activity log stream to reach the Sentinel workspace through diagnostic settings.

    1. Which diagnostic settings are required for Azure Activity

    For Azure Activity, configure subscription-level diagnostic settings and send the logs to the target Log Analytics workspace.

    Supported configuration path:

    1. In Azure portal, go to Subscriptions.
    2. Select the target subscription.
    3. Open Activity Log.
    4. Select Export Activity Logs or go to Diagnostic settings for the subscription.
    5. Select Add diagnostic setting.
    6. Enter a name.
    7. Select Send to Log Analytics.
    8. Choose the target Subscription and Log Analytics workspace where Sentinel resides.
    9. Select the log categories to collect, then Save.

    The troubleshooting guidance also says to verify that the correct Log Analytics workspace is selected in diagnostic settings.

    1. Whether Content Hub install and Azure Policy Assignment wizard are required

    No document here states that Azure Activity requires Azure Policy Assignment to work. The Sentinel prerequisites for Azure Activity state that this connector now uses the diagnostic settings pipeline, and if the legacy method is in use, existing subscriptions must be disconnected from the legacy method before setting up the new Azure Activity log connector.

    The standalone connector guidance shows a direct configuration path from Microsoft Sentinel > Data connectors > Azure Activity > Open connector page, then opening the resource configuration page and creating Diagnostic settings that send data to the Sentinel workspace.

    Azure Policy is documented as a prerequisite for connectors that are managed by Azure Policy. The provided Azure Activity guidance specifically emphasizes the diagnostic settings pipeline and disconnecting the legacy method first.

    1. What to do if diagnostic settings were already configured manually

    If manual diagnostic settings already exist for the target subscription, verify these items:

    1. The destination is the same Log Analytics workspace where Microsoft Sentinel is enabled.
    2. The diagnostic setting is configured at the subscription Activity Log level.
    3. The account has read and write permissions on the Log Analytics workspace enabled for Microsoft Sentinel.
    4. If the source used the legacy Azure Activity method, disconnect existing subscriptions from the legacy method before setting up the new Azure Activity connector:
      • In Microsoft Sentinel > Data connectors
      • Select Azure Activity
      • Select Open connector page
      • Under Instructions, review subscriptions connected through the legacy method
      • Select Disconnect All
    5. Save the diagnostic settings and allow time for the connector status to update. Similar accepted guidance indicates this can take 45 minutes to 1 hour.
    6. How to verify export to the target workspace

    Use Log Analytics queries in the target workspace:

    AzureActivity
| where SubscriptionId contains "<YourSubscriptionId>"

    To confirm ingestion volume by day:

    AzureActivity
| summarize count() by bin(TimeGenerated,1d)

    If data is present, the subscription is exporting Activity Log events to the workspace. Azure Activity data in Log Analytics is stored in the AzureActivity table.

    Recommended migration approach from legacy to diagnostic-settings-based ingestion:

    1. In the target tenant, ensure Microsoft Sentinel is enabled on the target Log Analytics workspace.
    2. In Sentinel, open Azure Activity under Data connectors.
    3. If any subscription is still connected through the legacy method, disconnect it.
    4. Configure subscription-level Activity Log diagnostic settings to send logs to the target Sentinel workspace.
    5. Verify workspace permissions and connector settings.
    6. Validate ingestion with the AzureActivity queries above.

    If logs do not appear, the documented checks are:

    • confirm the correct workspace is selected
    • review the diagnostic settings configuration
    • validate connector settings
    • confirm workspace permissions
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.