Wazuh MS Graph Trace: Entra ID Sign-Ins to Indexer

Updated 14 November 2026 · Standard formula, shown below

Yes, Wazuh can ingest Microsoft Graph activity logs, including Entra ID (Azure AD) sign-in logs, and index them for searching and alerting. You configure the Wazuh manager to pull these logs via the Microsoft Graph API and forward them to the indexer, where they become searchable events. This article explains the architecture, setup steps, and common pitfalls.

Background: Wazuh and Microsoft Graph

Wazuh is an open-source security monitoring platform that collects and analyzes logs from various sources. Its modular architecture includes a manager (server), agents, and an indexer (formerly Elasticsearch). To ingest logs from cloud services like Microsoft 365, Wazuh uses integration modules that connect to external APIs. Microsoft Graph is the unified API for Microsoft 365 services, including Entra ID (the new name for Azure Active Directory). Sign-in logs from Entra ID provide a record of who authenticated, when, from where, and with what result—critical for security monitoring.

How the Integration Works

The Wazuh manager runs a Python-based integration script (e.g., ms-graph.py) that periodically calls the Microsoft Graph API to fetch new log entries. The script uses OAuth 2.0 client credentials to authenticate. It then processes the JSON responses and converts them into Wazuh-compatible event formats, which are sent to the Wazuh indexer for storage and analysis. The indexer uses Elasticsearch under the hood, so the data becomes searchable via Kibana (Wazuh dashboard).

Key components:

Microsoft Entra ID (Azure AD) tenant – The directory that contains the users and sign-in logs.
App registration – An application in Entra ID with the necessary API permissions (e.g., AuditLog.Read.All and Directory.Read.All).
Client secret or certificate – Used for authentication.
Wazuh manager – Runs the integration script, stores state, and forwards events.
Wazuh indexer – Stores and indexes the events for querying.

Setting Up the Integration

To get sign-in logs flowing from Microsoft Graph to your Wazuh indexer, follow these general steps. (Exact menu names may vary by Wazuh version.)

Register an application in the Microsoft Entra admin center. Give it a name, select “Accounts in this organizational directory only,” and create a client secret.
Assign API permissions to the app: add AuditLog.Read.All and Directory.Read.All (both are application permissions, not delegated). Grant admin consent for your tenant.
Configure the Wazuh manager by editing ossec.conf to add the integration block for Microsoft Graph. Specify the tenant ID, client ID, and client secret (or certificate path). Set the interval (e.g., 1h) and the log types you want (signIn, audit, etc.).
Restart the Wazuh manager so the new configuration takes effect.
Verify data flow by checking the Wazuh dashboard for new events with the data.graph.signIn or similar fields.

Here is a minimal example of the integration block in ossec.conf (replace placeholders):

<integration>
  <name>ms-graph</name>
  <group>azure</group>
  <alert_format>json</alert_format>
  <hook_url>https://graph.microsoft.com/v1.0/auditLogs/signIns</hook_url>
  <api_key>tenant_id:client_id:client_secret</api_key>
</integration>

Note that the hook_url and api_key format may differ; always consult the official Wazuh documentation for your version.

Common Problems and Troubleshooting

Several issues can prevent sign-in logs from reaching the indexer:

401 Unauthorized – Incorrect client secret, expired secret, or missing admin consent. Double-check the secret and that the app has the required permissions.
403 Forbidden – The app lacks the necessary API permissions or the tenant does not have an appropriate license (e.g., Azure AD Premium P1 or P2 is required for sign-in logs).
No data after initial setup – The integration fetches logs from the last 24 hours by default. If you expect older logs, use the start_time parameter. Also, check that the Wazuh manager’s timezone is correct.
Duplicate events – The integration uses a cursor to track the last fetched log. If the state file is corrupted or deleted, duplicates may appear. Ensure the state file (usually /var/ossec/var/ms-graph.state) is writable.
Indexer not receiving data – Check that the Wazuh manager’s ossec.conf has the correct indexer output configured, and that the indexer is running and reachable.

Comparison with Other Methods

There are alternative ways to get Entra ID sign-in logs into Wazuh:

Microsoft Sentinel connector – Sentinel can export logs to a Log Analytics workspace, which Wazuh can then query. This adds cost and complexity.
Manual export via PowerShell – You can script a PowerShell job to export sign-in logs and push them to Wazuh. This is less reliable and harder to maintain.
Third-party connectors – Some SIEM tools offer native connectors, but Wazuh’s built-in integration is free and straightforward.

The built-in integration is generally the most efficient for Wazuh users because it requires no extra licensing beyond the Wazuh platform itself.

Costs and Licensing Considerations

Wazuh is open-source and free to use, but Microsoft Entra ID sign-in logs require an Azure AD Premium P1 or P2 license. Without a premium license, the Graph API returns a 403 error for sign-in logs. The cost of the license depends on your organization’s size and Microsoft agreements; there is no per-log cost. You also need to consider the storage cost for the Wazuh indexer, which is self-hosted or cloud-based depending on your deployment.

Security and Best Practices

When handling sign-in logs, follow these practices:

Protect the client secret – Store it in a secure location (e.g., a secrets manager) and rotate it regularly. Avoid hardcoding it in configuration files that might be exposed.
Use least privilege – Only grant the API permissions necessary for the integration. The AuditLog.Read.All permission is sufficient for sign-in logs; you may not need Directory.Read.All unless you also fetch directory data.
Monitor the integration itself – Set up alerts for when the integration fails to fetch logs, as this could indicate a security issue or misconfiguration.
Retain logs appropriately – Sign-in logs are sensitive; ensure the indexer has proper access controls and encryption at rest.

Frequently Asked Questions

Can I get sign-in logs without Azure AD Premium?

No, Microsoft requires an Azure AD Premium P1 or P2 license to access sign-in logs via the Graph API. Free tiers do not include this data. You can verify your license in the Microsoft 365 admin center.

How often does Wazuh fetch new sign-in logs?

You control the interval in the integration configuration. The default is often 1 hour, but you can set it to as low as 5 minutes. Keep in mind that the Graph API has throttling limits, so very frequent calls may hit rate limits.

Does the integration support certificates instead of client secrets?

Yes, Wazuh’s integration supports certificate-based authentication. You specify the certificate path in the api_key field (e.g., tenant_id:client_id:cert_path). This is more secure than a secret.

Why do I see only a few sign-in events, not all?

By default, the integration fetches logs from the last 24 hours. If you need historical data, use the start_time parameter in the configuration. Also, ensure that the sign-in logs are actually being generated (e.g., users are signing in).

Can I filter which sign-in events are sent to the indexer?

Yes, you can use Wazuh rules to filter or alert on specific events after they are indexed. You can also modify the integration script to fetch only certain log types, but that requires custom development.

What fields are available in the indexed sign-in events?

Each sign-in event includes fields like userPrincipalName, appDisplayName, ipAddress, clientAppUsed, status (success/failure), and createdDateTime. These are mapped to Wazuh’s JSON structure and are searchable in the dashboard.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.