Microsoft Sentinel Series : Enable Azure Activity Connector

As part of our ongoing series on Microsoft Sentinel, this tutorial will guide you through enabling the Azure Activity Connector. By connecting Azure Activity logs to Microsoft Sentinel, you can gain deeper insights into your environment’s security posture and ensure better threat detection and response capabilities.

Why Enable the Azure Activity Connector?

1. Enhanced Visibility: Gain comprehensive insights into user and resource activities across your Azure environment.
2. Improved Threat Detection: Identify potential security incidents and anomalies with better contextual information.
3. Streamlined Incident Response: Access detailed activity logs to expedite investigation and response to security incidents.

Prerequisites

Before enabling the Azure Activity Connector, ensure you have the following:

• An active Microsoft Azure subscription.
• Microsoft Sentinel workspace set up in your Azure portal.
• Appropriate permissions to configure connectors in Microsoft Sentinel.

Steps :

1. Log in to your Azure portal and navigate to Microsoft Sentinel.

• In the Azure portal, search for “Microsoft Sentinel” and select it from the search results.
• Select the Sentinel workspace where you want to enable the connector.

2. Install from “Content hub” > You will see a list of available data connectors. Find and select “Azure Activity” > Choose the Blue Button “Install”

3. Then on the left side navbar, go to the “Data Connectors” > Click for more details like image below > Launch Azure Policy Assigment Wizard

4. Configure and Create the policy like below

5. Finish and wait the log.

Conclusion

Enabling the Azure Activity Connector in Microsoft Sentinel is a straightforward process that significantly enhances your ability to monitor and secure your Azure environment. By following this tutorial, you can ensure that your Sentinel workspace is receiving critical activity logs, providing you with the insights needed to detect and respond to potential threats effectively.

Stay tuned for more articles in our Microsoft Sentinel series, where we will cover additional connectors, advanced configurations, and best practices for maximizing the value of your SIEM solution.