CISA.MS.AAD.4.1 - Security logs SHALL be sent to the agency's security operations center for monitoring.
Overview
Security logs SHALL be sent to the agency's security operations center for monitoring.
Rationale: The security risk of not having visibility into cyber attacks is reduced by collecting logs in the agency’s centralized security detection infrastructure. This makes security events available for auditing, query, and incident response.
Note: The following logs (configured in Entra diagnostic settings), are required: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents, EnrichedOffice365AuditLogs, MicrosoftGraphActivityLogs. If managed identities are used for Azure resources, also send the ManagedIdentitySignInLogs log type. If the Entra ID Provisioning Service is used to provision users to software-as-a-service (SaaS) apps or other systems, also send the ProvisioningLogs log type.
Note: Agencies can benefit from security detection capabilities offered by the CISA Cloud Log Aggregation Warehouse (CLAW) system. Agencies are urged to send the logs to CLAW. Contact CISA at cyberliason@cisa.dhs.gov to request integration instructions.
Remediation action:
Follow the configuration instructions unique to the products and integration patterns at your organization to send the security logs to the security operations center for monitoring.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | CISA.MS.AAD.4.1 |
| Severity | High |
| Suite | CISA |
| Product | Entra ID |
| Feature | Logs and monitoring |
| Area | Logging and detection |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1685.002 Disable or Modify Cloud Log |
| Supports benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 (version ScubaGear main, 2026-10-11), requirement MS.AAD.4.1 |
| Criticality | SHALL |
| Upstream requirement | MS.AAD.4.1v1 |
| Supports controls | cisa-scuba:MS.AAD.4.1, nist-800-53-r5:AU-4 |
| PowerShell test | Test-MtCisaDiagnosticSettings |
| Services | Graph, Azure |
| Compatible licenses | AAD_PREMIUM |
Source
- Test:
tests/cisa/entra/Test.CISA.MS.AAD.4.1.ps1 - Documentation:
tests/cisa/entra/Test.CISA.MS.AAD.4.1.md