How Much Microsoft Entra ID (Azure AD) Log Data Can zcrLog Actually Collect? The Real Scope, Today
zcrLog really connects to Microsoft Entra ID (Azure AD) — sign-in and audit logs. But Microsoft only keeps them 30 days. See what's covered, read the guide.
How Much Microsoft Entra ID (Azure AD) Log Data Can zcrLog Actually Collect? The Real Scope, Today
"Can zcrLog pull logs from Azure AD?" It's a common enough question to deserve a full article instead of a one-line answer. The short version is "yes" — but the fuller answer has a scope you should know before deciding whether it's enough for what you actually need.
First, a quick note on naming. Microsoft renamed Azure Active Directory to Microsoft Entra ID, but plenty of admins still call it Azure AD out of habit. This article uses both names interchangeably — they refer to the same service.
What zcrLog Actually Connects to Today
zcrLog's Custom Integrations catalog lists Microsoft Entra ID under "Cloud Identity Integrations" with an Available status — collecting sign-in logs, audit logs, and directory activity from Azure AD, tagged with four capabilities (see the zcrLog product page for the current integration list):
- Sign-in Logs — who logged in, from where, and whether it succeeded
- Audit Logs — who changed what in the system: adding a new user, changing permissions, creating an app registration
- Directory Sync — activity recorded within the directory itself
- Multi-tenant — connect more than one tenant under a single account
All of that is usable right now — not a roadmap item, not something "coming soon." And Entra ID isn't the only Microsoft source: zcrLog also collects Microsoft 365 audit logs from Exchange, SharePoint and Teams, which travel on a different pipeline (more on that below).
What's Not Covered Yet, and Where Microsoft 365 Fits
Google Workspace and Okta are still marked Coming Soon — not supported yet, and there's no toggle to switch them on. AWS CloudTrail is a different story: zcrLog collects it today.
The part that trips people up more often is the rest of the Microsoft 365 suite — Exchange, SharePoint and Teams. Those aren't in the Cloud Identity Integrations section, because activity in those apps is logged in the Unified Audit Log (UAL), a completely separate system from Entra ID's own logs, managed through Microsoft Purview Audit with its own pipeline and its own retention policy. zcrLog connects to that side too: on top of Entra ID's sign-in, audit and directory activity, it collects Exchange, SharePoint and Teams audit logs through the Office 365 Management API. So if your organization also needs activity logs from Exchange or SharePoint, zcrLog covers them. zcrSIEM, a separate product, also pulls Exchange, SharePoint and Teams audit activity through the Office 365 Management API.
So if you were hoping to cover Microsoft 365 with zcrLog alone, you can: sign-in and audit logs from Entra ID, and in-app activity from Exchange, SharePoint and Teams. The two just come from different Microsoft pipelines, which is worth knowing before you plan the rollout.
Why Bother Centralizing This When Microsoft Already Keeps It?
The natural follow-up: Microsoft already stores sign-in and audit logs on its own, so why send them anywhere else? The answer comes down to how long Microsoft actually keeps them — shorter than most people assume. Per Microsoft's own documentation (learn.microsoft.com's data retention page for Entra ID reports):
| Report | Entra ID Free | Entra ID P1 | Entra ID P2 |
|---|
| Audit logs | 7 days | 30 days | 30 days |
| Sign-ins | 7 days | 30 days | 30 days |
| MFA usage | 30 days | 30 days | 30 days |
| Risky sign-ins | 7 days | 30 days | 90 days |
Notice that even at the top-tier P2 license, basic sign-in and audit logs still cap out at 30 days — the only report that stretches to 90 days is risky sign-ins specifically. And there's another detail people tend to forget: this retention is not retroactive. Once a log older than 30 days is gone, upgrading your license the next day won't bring it back. Someone has to export the logs before Microsoft deletes them — there's no other way around it.
Worth clearing up one more point of confusion, in case you've heard numbers like 90 days or a year floated around before — those figures belong to the Unified Audit Log (UAL) managed through Microsoft Purview Audit, mentioned above, which is a completely different dataset from the Entra ID sign-in/audit log table shown here. Microsoft says as much directly in its own documentation: UAL retention isn't tied to Entra ID licensing at all. So the 30-day figure in the table above is the real number for Entra ID's own sign-in and audit logs — not 90 days or a year, which some sources conflate.
Thirty days sounds like enough, until you hit a case that needs to go back further — an internal audit team asking for 45 days of history, or an incident that only comes to light more than a month later. That happens more often than you'd think. This is exactly the gap that shipping logs out to long-term storage in zcrLog closes — retention that isn't tied to whatever Microsoft license tier you're on.
Real Cases These Logs Actually Catch
These two log types aren't just there to answer "who logged in and when." They're also the raw material behind several detection patterns Microsoft itself builds on top of the same logs. Two worth knowing about:
Atypical Travel — Logins From an Unusual Location
Microsoft Entra ID Protection has a detection called Atypical travel, defined in Microsoft's own documentation as identifying two sign-ins from geographically distant locations where at least one location is also atypical for that user's normal behavior. This detection requires a P2 license and is calculated offline — meaning it needs a history of sign-in logs to compare against before it can flag anything as "atypical." Which loops right back to the earlier point: if logs disappear on a 30-day cycle, the behavioral baseline you're comparing against is just as short.
Consent Phishing — Account Takeover Without Stealing a Password
Another case Microsoft warns about directly: consent phishing. An attacker registers a fake app in Entra ID and tricks a user into clicking "Accept" on an OAuth consent prompt, granting that app standing access to the account's data. The result is access that survives a password reset and doesn't require re-passing MFA to maintain. What makes this case interesting is that it's a purely identity-layer attack — nothing shows up in any machine's Windows Event Log. The only place you'd see the suspicious consent grant is in Entra ID's own audit log.
Cloud Identity vs. On-Prem Active Directory — What's the Difference?
Plenty of organizations running Entra ID today still run on-prem AD alongside it in a hybrid setup rather than going fully cloud. The two systems log different things and answer different questions.
| Aspect | On-Prem Active Directory | Microsoft Entra ID (Cloud) |
|---|
| Primary data source | Windows Event Log on the Domain Controller | Sign-in log / Audit log via Microsoft's API |
| Example of what you'd see | Kerberoasting, lateral movement, group permission changes | Login from an unusual IP, consent granted to a rogue app, tenant-level permission changes |
| Requires an on-prem server? | Yes, a Domain Controller | No — fully cloud-hosted |
| Default retention from Microsoft | None — you have to collect it all yourself | 7–30 days depending on license (see table above) |
See zcrLog packages and pricing →
Compliance and Thailand's Computer Crime Act
For organizations in Thailand that need to answer questions about legally required log retention periods, we've written a separate, detailed breakdown of the numbers and requirements in Thailand's Computer Crime Act B.E. 2560 — a distinct issue from the Microsoft retention discussed in this article. Short version: the two need to be evaluated separately. Entra ID's retention only tells you how long Microsoft keeps data before deleting it; the law separately dictates how long your organization must keep its own copy, which is usually well beyond Microsoft's 30-day window anyway.
If an Account Gets Taken Over, What's the First Signal You'd See?
Entra ID's sign-in and audit logs aren't just useful for after-the-fact investigation — they're also the first data set that flags trouble before it spirals. If you want to see what these signals actually look like in practice, we covered it step by step in Account Takeover After a Phishing Click, published earlier.
Frequently Asked Questions
Can zcrLog pull logs from Exchange, SharePoint, or Teams?
Yes. Besides Microsoft Entra ID (sign-in logs, audit logs and directory activity), zcrLog collects Exchange, SharePoint and Teams audit logs through the Office 365 Management API. Those app logs come from a separate pipeline, Microsoft's Unified Audit Log, rather than from Entra ID itself. zcrSIEM, a separate product, also collects Exchange, SharePoint and Teams audit activity through the Office 365 Management API.
What about Google Workspace or AWS CloudTrail?
AWS CloudTrail, yes: zcrLog collects it today, and zcrSIEM, a separate product, collects it too. Google Workspace and Okta are still marked Coming Soon in zcrLog, and neither product collects Google Workspace today.
Do I need an Entra ID P1 or P2 license before I can connect to zcrLog?
The retention table above covers Free, P1, and P2 — but we haven't independently confirmed the minimum license zcrLog itself needs for API read access on your tenant. Before you set anything up, get the requirement confirmed: send your current license tier through the contact details at the end of this article. Risk-detection features like Atypical travel are a Microsoft-side feature (not zcrLog's), and those specifically do require a P2 license.
Get in Touch
Want to know if the Entra ID logs your organization already has can connect to zcrLog right now, or want to try the Custom Integrations page yourself? Talk to our team, free of charge.
Sources