What this connection does

Microsoft Sentinel receives new, redacted EmDash audit events through the Azure Monitor Logs Ingestion API. The destination is outbound-only: EmDash does not read alerts from Sentinel and does not replay historical audit events automatically.

Prerequisites

  • A user with integrations:manage to configure and operate the destination. integrations:read can view status and delivery health.
  • An Azure Data Collection Rule (DCR) with a custom stream/table that matches your ingestion schema.
  • The DCR immutable ID, stream name, and the public DCE Logs Ingestion endpoint.
  • An Entra application with a directory ID, client ID, and client secret. Grant the application the Monitoring Metrics Publisher role on the DCR (or the equivalent role required by your Azure setup).
  • A public Data Collection Endpoint (DCE). Private-link-only DCE deployments are not supported; use a public DCE ingestion endpoint.
  • Permission to create or update the destination in EmDash and to validate the Azure resource configuration.

Prepare Azure

The Azure portal creates the table schema from an uploaded sample. It does not provide editable type or rename controls in the sample preview, and the transformation editor is unavailable until a sample has been uploaded. The steps below follow the Create a custom log wizard shown in the portal.

  1. In the Azure portal, open Log Analytics workspace → Tables → Create custom log.
  2. On Basics, enter a new table name such as EmDashAuditEvents. Azure appends _CL, so the resulting table is EmDashAuditEvents_CL.
  3. Select the DCR and DCE that will receive the data, then select Next.
  4. On Schema and transformation, select Upload sample file. Upload a JSON array containing every field you want to support, including CorrelationId.
  5. Use redacted, non-production values. A value such as tenant-demo keeps the sample TenantId as a string; a UUID-shaped sample value can be inferred as a GUID by the portal.
  6. Register an Entra application for ingestion, create a client secret, and assign the application the Monitoring Metrics Publisher role on the DCR.
  7. Record the DCR immutable ID, the DCE’s public properties.logsIngestion.endpoint, and the exact stream declaration name shown by the DCR. The immutable ID is not the same as the display name. A portal-created DCR may not expose a direct ingestion endpoint of its own; in that case, use the endpoint from the linked DCE’s JSON view.

Sample file

Save this as emdash-sentinel-sample.json and upload it in the wizard:

[
  {
    "TimeGenerated": "2026-09-03T11:03:27.756Z",
    "EventId": "event-demo-001",
    "TenantId": "tenant-demo",
    "Category": "admin",
    "Action": "Exported audit trail",
    "Outcome": "success",
    "Actor": "actor-demo",
    "Resource": "resource-demo",
    "CorrelationId": "correlation-demo-001",
    "Metadata": "{}"
  }
]

The sample is only for schema inference. Do not upload a production export containing customer identifiers or sensitive metadata.

Transformation editor

After the sample is uploaded, select Transformation editor, replace the generated query, and select Run:

source
| project
    TimeGenerated = todatetime(TimeGenerated),
    EventId_CF = tostring(EventId),
    EmDashTenantId_CF = tostring(TenantId),
    Category_CF = tostring(Category),
    Action_CF = tostring(Action),
    Outcome_CF = tostring(Outcome),
    Actor_CF = tostring(Actor),
    Resource_CF = tostring(Resource),
    CorrelationId_CF = tostring(CorrelationId),
    Metadata_CF = tostring(Metadata)

The transformation runtime used by this wizard does not support column_ifexists(). If the query reports Undefined symbol: CorrelationId, upload the sample again with a CorrelationId property, or remove the CorrelationId_CF line when that field is not required.

The input stream keeps the names sent by EmDash (TenantId, CorrelationId, and so on). The transformation maps them to destination custom-table columns. TenantId is reserved by Azure, so use EmDashTenantId_CF; custom destination columns use the _CF suffix. Identifiers are strings in the DCR input and output schema, while TimeGenerated is datetime.

Select Apply, continue to Review, and create the custom log. The DCR output stream must match the table created by the wizard. When configuring EmDash, copy the exact input stream declaration name from the DCR definition rather than guessing it from the table name.

Configure Microsoft Sentinel in EmDash

  1. Open Settings → Integrations and select Microsoft Sentinel.
  2. Enter the DCE Ingestion endpoint, DCR immutable ID, and Stream name (for example, a custom EmDashAudit_CL stream that you created). Use the public Logs Ingestion endpoint from the DCE JSON view (properties.logsIngestion.endpoint), not the DCE resource ID and not the DCR immutable ID.
  3. Enter the Entra Directory ID and Client ID, then paste the Client secret. A stored secret is write-only; re-enter it only when creating or rotating it.
  4. Select Save, then Test connection. EmDash obtains the OAuth client-credentials token server-side and validates the Logs Ingestion request.
  5. After a successful test, select Enable. Confirm that the destination shows enabled state and monitor pending, delivered, retry, and dead-letter health.

Create the DCR stream from an audit export

Open Audit Trail, choose the desired category/outcome/action filters, and select Export JSON. The downloaded array uses the same flattened field names delivered to Sentinel:

[
  {
    "TimeGenerated": "<event occurred_at in RFC3339 UTC>",
    "EventId": "<audit-event-id>",
    "TenantId": "<tenant-id>",
    "Category": "admin",
    "Action": "Updated tenant setting",
    "Outcome": "success",
    "Actor": "<actor-id>",
    "Resource": "<resource-id>",
    "CorrelationId": "<correlation-id>",
    "Metadata": "{}"
  }
]

The timestamp is read from the event; EmDash does not insert a current or synthetic date. The export preserves the selected filters, and [] means that no rows matched them. Clear filters or enable Show system events if you need automated events in the export. Metadata is redacted and secrets, tokens, message bodies, attachments, and raw provider payloads are excluded.

If a table already has the wrong type

If Azure reports TenantId [produced: String, output: Guid], the existing destination column cannot be converted through this wizard. Do not try to rename it in the sample preview. Create a replacement table and DCR with a new table name, use EmDashTenantId_CF as the string destination column, and test ingestion before changing the EmDash integration. Update EmDash with the replacement DCR immutable ID and exact stream name, then retain the old table until the new path is verified.

Portal-created custom-log DCRs may require JSON, ARM, REST, or CLI editing rather than portal editing. The DCR input stream must declare identifier fields as string; guid is not a supported DCR stream-declaration type.

Permissions and data boundaries

The client secret is encrypted and stored server-side; it is never returned to the browser or included in audit events. EmDash sends redacted, tenant-scoped audit data only. It does not send message bodies, attachments, access tokens, or raw provider responses, and does not query Sentinel for detections.

Troubleshooting

  • OAuth unauthorized: verify directory ID, client ID, client secret, tenant consent, and the DCR role assignment.
  • DCR or stream not found: use the immutable DCR ID and exact stream name, including case and custom-table suffix.
  • TenantId [produced: String, output: Guid]: create a replacement table/DCR and map the input TenantId to the string column EmDashTenantId_CF. Existing column types are not editable in this wizard.
  • Undefined symbol: CorrelationId: re-upload a sample containing CorrelationId, then use tostring(CorrelationId). Do not use column_ifexists() in this portal editor because it is not available in this transformation runtime.
  • TLS or endpoint error: verify that the configured DCE Ingestion endpoint is the public HTTPS value from properties.logsIngestion.endpoint. Private-link-only endpoints cannot be reached by EmDash.
  • Test succeeds but delivery retries: inspect the destination’s sanitized health, Azure response status, and stream schema; transient provider failures retry with backoff.
  • Cannot enable: save a valid secret and complete a successful test first.
  • Secret rotation: enter the new client secret, save, test, then enable again if the destination was paused.

See Roles and permissions for the management boundary and support for help. Share only sanitized error codes and timestamps, never the client secret or OAuth token.