Set up streaming from Microsoft Entra ID logs to event hub

To set up streaming from Microsoft Entra ID:

1. In Azure Portal, click Microsoft Entra ID in the side navigation pane.
   
2. Scroll down to Monitoring in the side menu and click Audit logs.
   
3. Click Export Data Settings.
   
4. Click +Add diagnostics setting.
   Alternatively, if you already have a logging configuration set up, click Edit Settings next to the diagnostic setting.
   
5. Tick these Logs checkboxes:
   • AuditLogs 
   • SignInLogs 
   • NonInteractiveUserSignInLogs 
   • ServicePrincipalSignInLogs 
   • ManagedIdentitySignInLogs 
   • ProvisioningLogs 
   • ADFSSignInLogs 
   • RiskyUsers 
   • UserRiskEvents 
6. Tick Stream to an event hub.
7. Select the event hub namespace and event hub that you created earlier.
   If you don’t select an event hub, Azure Portal will create an event hub called insights-logs-audit in the selected namespace.
8. Click Save.