Configure Microsoft Sentinel for Event Logs

This guide walks through setting up Microsoft Azure Sentinel to receive Enpass audit logs using the Logs Ingestion API. You'll create a Microsoft Entra app registration for API authentication, a Data Collection Endpoint (DCE) to receive incoming data, and a Data Collection Rule (DCR) to define how logs are routed to your Log Analytics workspace. Once the Azure resources are configured, you'll enter the collected credentials in the Enpass Admin Console to complete the integration.

Prerequisites

Before you begin, ensure you have:

• An Azure subscription.

• Permissions to create Azure resources.

• Permission to create Microsoft Entra applications and assign Azure roles.

• Access to the Log Analytics Workspace where Enpass audit logs will be stored.

Configuration

Complete the following steps to configure Microsoft Sentinel for Enpass.

Step 1 – Create a Microsoft Entra Application

Create a Microsoft Entra application and generate a client secret by following Microsoft's official documentation.

Microsoft Documentation

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-microsoft-entra-application

Record the following values after completing this step:

Important

The Client Secret Value is displayed only once during creation. Store it securely, as it will be required when configuring the Enpass integration.

Step 2 – Create or Select a Log Analytics Workspace (Optional)

Enpass audit logs are stored in a Log Analytics Workspace.

If you already have a Log Analytics Workspace or Microsoft Sentinel deployment, you can reuse it. Otherwise, create a new workspace by following Microsoft's documentation.

Microsoft Documentation

https://learn.microsoft.com/en-in/azure/azure-monitor/logs/quick-create-workspace?tabs=azure-portal

Important

Note the Azure region of your Log Analytics Workspace. The Data Collection Endpoint (DCE) created in the next step must be deployed in the same region.

Step 3 – Create a Data Collection Endpoint (DCE)

Create a Data Collection Endpoint (DCE) by following Microsoft's documentation.

Microsoft Documentation

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-data-collection-endpoint

After the DCE is created, copy the Logs ingestion URI.

This value will be used later as: AZURE_DCE_URI

Step 4 – Create the Custom Table and Data Collection Rule (DCR)

Create a custom table and Data Collection Rule (DCR) by following Microsoft's official documentation.

Microsoft Documentation

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-new-table-in-log-analytics-workspace

During the setup, Azure will prompt you to upload a sample JSON file to generate the table schema. Use the sample provided below.

Sample JSON

Create a file named sample-logs.json and copy the following content into it.

[
  {
    "id": "00000000-0000-0000-0000-000000000001",
    "category": "user",
    "component": "application",
    "action": "shared_vault_permission_updated",
    "description": "Updated 2 user(s) permissions for the shared vault to Read-only.",
    "actor": "alice.doe@example.com",
    "target": null,
    "timestamp": "1700000000",
    "ip_address": "203.0.113.10",
    "severity": "MEDIUM",
    "device": {
      "os": "osx",
      "name": "Example Desktop",
      "device_type": "desktop"
    },
    "software": {
      "version": "6.11.10",
      "code": "com.example.enpass.desktop"
    },
    "data": {
      "permission": {
        "is_manager": false,
        "is_readonly": true,
        "is_autofill_only": false
      },
      "target_users_count": 2
    }
  },
  {
    "id": "00000000-0000-0000-0000-000000000002",
    "category": "organization",
    "component": "application",
    "action": "password_rule_added",
    "description": "Added a new password rule for default_recipe.",
    "actor": "bob.smith@example.org",
    "target": null,
    "timestamp": "1700000600",
    "ip_address": "198.51.100.23",
    "severity": "LOW",
    "device": {},
    "software": {},
    "data": {}
  }
]

Note

This file contains sample data only and is used solely for generating the table schema during setup. No real Enpass audit data is included.

Configure the Transformation

Enpass sends the timestamp field as a Unix epoch (in seconds). Configure the following transformation so Azure converts it into the required TimeGenerated field.

Replace the default transformation with:

source
| extend TimeGenerated = iif(
    isnotempty(timestamp) and timestamp != "null",
    datetime_add('second', tolong(timestamp), todatetime('1970-01-01')),
    now()
)

Run the transformation to verify that the TimeGenerated column is populated successfully.

Step 5 – Assign Required Permissions

The Microsoft Entra application created earlier must be granted permission to send logs through the Data Collection Rule.

Assign the Monitoring Metrics Publisher role to the application on the Data Collection Rule (DCR) by following Microsoft's documentation.

Microsoft Documentation

https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#assign-permissions-to-the-dcr

Important

Role assignments can take up to 30 minutes to propagate. If log ingestion initially fails with an HTTP 403 Forbidden error, wait for the permissions to take effect before troubleshooting further.

Optional

Assigning the Log Analytics Contributor role to the Microsoft Entra application is not required for Enpass log ingestion. This permission is only needed if your organization requires the application to manage Log Analytics workspace resources. For standard deployments, only the Monitoring Metrics Publisher role on the Data Collection Rule (DCR) is required.

Step 6 – Collect the Remaining Configuration Values

Open the Data Collection Rule (DCR) created in the Step 4 and collect the following values.

The Stream Name is listed under streamDeclarations in the DCR JSON and typically follows the format like:

Custom-EnpassAuditLogs_CL

At this point, you should have all six values required to configure the Enpass SIEM integration.

Step 7 – Integrate with Enpass Admin Console

1. Log in to the Enpass Admin Console.

2. Navigate to Settings > Event Logs.

3. Under the SIEM Integration section, click Configure.

4. Select Microsoft Sentinel from the list and click Continue.

5. Enter the 6 credentials we have gathered above in the form.

6. Click Verify & Save. This will trigger a test connection event.

7. In the Azure Portal, open the log analytics workspace and go to Logs.

8. Run this query: (replace with your table name)

EnpassAuditLogs_CL
| take 20

4. You should see rows, with a populated TimeGenerated column.

The first data can take 5 to 15 minutes to show up after the first batch if event logs.

Troubleshooting

Renewing the Client Secret

Client secrets have a configurable expiration period. Once the client secret expires, Enpass will no longer be able to authenticate with Azure, and log ingestion will stop.

To restore log ingestion:

1. Generate a new client secret for the Microsoft Entra application.

2. Update the AZURE_CLIENT_SECRET value in the Enpass Admin Console.

3. Save the configuration.

No other configuration values need to be changed.

References

• Event Categories & Field Reference

• Tutorial: Send data to Azure Monitor Logs with Logs ingestion API (Azure portal)

• Create a Log Analytics Workspace - Azure Monitor

• Data collection rules (DCR) in Azure Monitor

• Data collection rule transformations

• Microsoft Entra ID: client credentials authentication