Microsoft Entra ID log source parameters

When you add an Entra ID log source on the QRadar Console by using the Microsoft Azure Event Hubs protocol, there are specific parameters you must use.

The following table describes the parameters that require specific values to retrieve Microsoft Entra ID events from Microsoft Entra ID:
Table 1. Microsoft Azure Event Hubs protocol log source parameters for the Microsoft Entra ID DSM
Parameter Value
Log Source type Microsoft Entra ID
Protocol Configuration Microsoft Azure Event Hubs
Log Source Identifier

The Log Source Identifier can be any valid value, including the same value as the Log Source Name parameter, and doesn't need to reference a specific server. If you configured multiple Microsoft Entra ID log sources, you might want to identify the first log source as EntraID-1, the second log source as EntraID-2, and the third log source as EntraID-3.

For a complete list of Microsoft Entra ID protocol parameters and their values, see Microsoft Azure Event Hubs protocol configuration options.