Skip to content
Integrations/Azure Monitor Logs (Pull)/Connection Guide
Connection Guide

Connect Azure Monitor Logs (Pull) Without Breaking the Audit Trail

Use this guide to connect Azure Monitor Logs (Pull) or confirm the export-based path that fits your environment. Aurora keeps source, timestamps, ownership, and collection history attached so the first run becomes reusable proof instead of one-off setup work.

Connector Summary
Connection typeLog collection
CategoryLogging
Checklist2 steps
Want help with rollout?
We'll confirm what can be automated, what stays export-based, and how to keep the first evidence record clean.

First-Run Checklist

Use this sequence to connect Azure Monitor Logs (Pull) and make sure the first collection lands cleanly.

  1. 1
    Create app registration and grant access to Log Analytics workspace.
  2. 2
    Define base KQL query in connection config (`kql_query` required; `query` accepted as alias) and schedule.

Credentials and Secrets

The keys, secrets, or tokens Aurora uses to authenticate and collect proof.

client_idclient_secret

Recommended Access

Aurora only asks for the minimum read access needed for collection and checks.

Access requirements depend on the collection mode and scope you choose.