Collect Microsoft Entra Connect Sync Audit Events

Sat, 06 Sep 2025 15:32:18 +0000

Microsoft Entra Connect Sync now includes an admin audit logging capability that is enabled by default. This gives organizations visibility into configuration changes performed by Global Administrators, Hybrid Administrators, and local server administrators.

In this post, we walk through how to forward those Microsoft Entra Connect Sync audit events into Microsoft Sentinel for centralized monitoring and investigation.

Check the Microsoft Entra Connect Sync Version

In the Entra portal, go to Entra Connect > Connect Sync > Microsoft Entra Connect Health > Sync Services > your service > Microsoft Entra Connect Servers > your server > Properties > Synchronization.

Microsoft Entra Connect on Anything About IT

Collect Microsoft Entra Connect Sync Audit Events

Check the Microsoft Entra Connect Sync Version