Entra ID Log Analytics Not Populating with Any Data

Question

Entra ID Log Analytics Not Populating with Any Data

Evan Lieberman 20

I followed the instructions in this guide for sending entra logs to Azure Log Analytics Workspace.

https://learn.microsoft.com/en-us/entra/identity/monitoring-health/tutorial-configure-log-analytics-workspace

Everything seems to have gone fine and i have waited beyond the 15 minutes propagation time but neither the AuditLogs nor the EnrichedOffice365AuditLogs are sending any data to the Log Analytics Workspace.

Operational Logs are populating but only those within the Log Analytics Workspace itself.

I thought it could be a licensing issue and ensured that i had the full Entra Suite and verified the role permissions.

Vinod Pittala 1,750 Reputation points Microsoft External Staff

2025-04-28T06:38:44.0866667+00:00

Hello Evan Lieberman,

Apologies for the delay in my response.

I understand that you have been trying to send Entra logs to log analytics workspace.

Could you please confirm if you indeed have the Reader or Contributor access to the log analytics workspace? and also please check the appropriate query to see the logs.

it's recommended to monitor Ingestion Delays: There can be a delay in log ingestion after the initial configuration. Check the Usage tab in the Log Analytics Workspace to monitor ingestion and identify any delays. so that you can understand whether the required logs are sending to LAW with some delay or not.

useful link: Log Analytics Workspace Insights - Azure Monitor | Microsoft Learn

Kindly confirm if the provided solution resolves your issue. I look forward to your valuable feedback.

Thanks
Alex Burlachenko 4,550 Reputation points

2025-04-28T06:49:12.23+00:00
Dear Evan,

Thank you for reaching out. I’m sorry to hear you’re experiencing issues with data population in Log Analytics.

Verify Diagnostic Settings: Ensure Entra ID logs are correctly routed to the Log Analytics workspace.

Check Data Latency: Some logs may take up to 1-2 hours to appear.

Log Analytics data ingestion time

Review Permissions: Confirm you have Contributor or Log Analytics Contributor roles on the workspace.

Required permissions for Log Analytics

If the issue persists, please share additional details (e.g., error messages, screenshots of diagnostic settings).

Best regards,
Alex

P.S. If my answer was helpfull pls select it as an Answer
Vinod Pittala 1,750 Reputation points Microsoft External Staff

2025-04-29T06:23:09.4566667+00:00

Hello Evan Lieberman,

We haven't heard back from you regarding the advice we provided earlier. Could you please let us know if it was helpful? If you have any questions or encounter any issues, please don't hesitate to reach out. We are committed to resolving your concerns as a priority.

Thanks

Accepted answer

0 additional answers

Your answer

Vinod Pittala 1,750 Reputation points Microsoft External Staff

2025-04-28T06:38:44.0866667+00:00

Hello Evan Lieberman,

Apologies for the delay in my response.

I understand that you have been trying to send Entra logs to log analytics workspace.

Could you please confirm if you indeed have the Reader or Contributor access to the log analytics workspace? and also please check the appropriate query to see the logs.

it's recommended to monitor Ingestion Delays: There can be a delay in log ingestion after the initial configuration. Check the Usage tab in the Log Analytics Workspace to monitor ingestion and identify any delays. so that you can understand whether the required logs are sending to LAW with some delay or not.

useful link: Log Analytics Workspace Insights - Azure Monitor | Microsoft Learn

Kindly confirm if the provided solution resolves your issue. I look forward to your valuable feedback.

Thanks
Alex Burlachenko 4,550 Reputation points

2025-04-28T06:49:12.23+00:00

Dear Evan,

Thank you for reaching out. I’m sorry to hear you’re experiencing issues with data population in Log Analytics.

Verify Diagnostic Settings: Ensure Entra ID logs are correctly routed to the Log Analytics workspace.

Check Data Latency: Some logs may take up to 1-2 hours to appear.

Log Analytics data ingestion time

Review Permissions: Confirm you have Contributor or Log Analytics Contributor roles on the workspace.

Required permissions for Log Analytics

If the issue persists, please share additional details (e.g., error messages, screenshots of diagnostic settings).

Best regards,
Alex

P.S. If my answer was helpfull pls select it as an Answer
Vinod Pittala 1,750 Reputation points Microsoft External Staff

2025-04-29T06:23:09.4566667+00:00

Hello Evan Lieberman,

We haven't heard back from you regarding the advice we provided earlier. Could you please let us know if it was helpful? If you have any questions or encounter any issues, please don't hesitate to reach out. We are committed to resolving your concerns as a priority.

Thanks

Answer 1

Alex Burlachenko 4,550

Dear Evan,

Thank you for reaching out. I’m sorry to hear you’re experiencing issues with data population in Log Analytics.

Verify Diagnostic Settings: Ensure Entra ID logs are correctly routed to the Log Analytics workspace.

Check Data Latency: Some logs may take up to 1-2 hours to appear.

Log Analytics data ingestion time

Review Permissions: Confirm you have Contributor or Log Analytics Contributor roles on the workspace.

Required permissions for Log Analytics

If the issue persists, please share additional details (e.g., error messages, screenshots of diagnostic settings).

Best regards, Alex

P.S. If my answer was helpfull pls select it as an Answer
p.p.s thats answer!

Evan Lieberman 20 Reputation points

2025-04-29T11:46:30.4066667+00:00

Thanks so much for the reply.

It is working now.

It appears the documentation is not correct regarding the 15 min delay. It took way longer than 15 min and then after 15 min, it appears there must have been a further back end propagation delay. Logs would sporadically ship to Log Analytics but randomly skip records. After some time, the logs became consistent and now works.

Thanks!

Share via

Entra ID Log Analytics Not Populating with Any Data

0 additional answers

Your answer