This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 93%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAB%3C/text%3E%3C/svg%3E)
Hi Team, I want to send Microsoft Entra I'd logs to event hub I want to know that can we use the RBAC functionality in Entra Id to retrieve designated logs for specific users or domains ? Without using log analytics, azure function etc . Just want to send logs from entra I'd diagnostic settings to event hub. Can you please help me here.
Thanks for reaching out. You may want to check How to stream activity logs to an event hub it guides you through the process for sending these logs to event hubs like Splunk, SumoLogic, and ArcSight.
As usual, if this answers your question, do click Accept Answer and Yes for what if this answer was helpful. And, if you have any further queries do let us know.
Marti
Hi @Marti Peig Thanks for response. I know that how to send logs from entra id to event hub but I want to know that if there is any way to send logs only related to specific domains or groups to event hub instead of all logs. For example. I have multienant organisation like example1.com and example2.com if I want only logs for example1.com domain without using log analytics and azure function etc. is it possible to do that ?
Hi @Marti Peig Thanks for response. I know that how to send logs from entra id to event hub but I want to know that if there is any way to send logs only related to specific domains or groups to event hub instead of all logs. For example. I have multienant organisation like example1.com and example2.com if I want only logs for example1.com domain without using log analytics and azure function etc. is it possible to do that ?
I don't think it is natively supported, nor possible. Maybe if you use something like Azure Event Hub + Azure Stream Analytics, before streaming to the even hub; but I'm not 100% sure it is feasible.
Cheers