CISA.MS.AAD.4.1: Security logs SHALL be sent to the agency's security operations center for monitoring.
| ID | CISA.MS.AAD.4.1 |
| Severity | High |
| Suite | CISA SCuBA baselines |
| Product | Entra ID |
| Feature | Logs and monitoring |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.4.1 (SHALL) |
| Framework controls | cisa-scuba:MS.AAD.4.1nist-800-53-r5:AU-4 Audit Log Storage Capacity |
| MITRE ATT&CK | T1685.002 |
| Reads from | Microsoft Graph, Azure Resource Manager |
| Licence needed | AAD_PREMIUM |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Security logs SHALL be sent to the agency’s security operations center for monitoring.
Rationale: The security risk of not having visibility into cyber attacks is reduced by collecting logs in the agency’s centralized security detection infrastructure. This makes security events available for auditing, query, and incident response.
Note: The following logs (configured in Entra diagnostic settings), are required: AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ADFSSignInLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents, EnrichedOffice365AuditLogs, MicrosoftGraphActivityLogs. If managed identities are used for Azure resources, also send the ManagedIdentitySignInLogs log type. If the Entra ID Provisioning Service is used to provision users to software-as-a-service (SaaS) apps or other systems, also send the ProvisioningLogs log type.
Note: Agencies can benefit from security detection capabilities offered by the CISA Cloud Log Aggregation Warehouse (CLAW) system. Agencies are urged to send the logs to CLAW. Contact CISA at cyberliason@cisa.dhs.gov to request integration instructions.
Remediation action:
Section titled “Remediation action:”Follow the configuration instructions unique to the products and integration patterns at your organization to send the security logs to the security operations center for monitoring.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.