# Microsoft Azure Sentinel (v2)

:::info
As of August 2026, a new version of the Microsoft Sentinel output is available. It adds a **managed Data Collection Rule (DCR)** mode that scales ingestion for higher throughput. Use **manual** mode for the original single-DCR behavior.
:::

Sends data to Microsoft Sentinel (Azure Monitor Logs) for querying and alerting.

## Overview

This output ingests records into Microsoft Sentinel through the Azure Monitor Logs Ingestion API, targeting a Data Collection Rule (DCR) and a stream defined on it. You choose how the DCR is provided:

- **Manual** — you supply a single DCR and Monad ingests into it.
- **Managed** — you supply a DCR's ARM resource ID and Monad manages the DCRs for you: it creates additional DCRs when needed to scale ingestion for higher throughput, and deletes them automatically as part of cleanup.

Individual records above 1 MB are rejected.

## Requirements

- An onboarded Log Analytics workspace with at least contributor rights.
- Permissions to create DCR objects in the workspace.
- **Managed mode only**: permission for the registered application to read, create, and delete Data Collection Rules under the workspace's subscription (Azure Resource Manager access).

## Setup

1. [Create a Microsoft Entra application](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-microsoft-entra-application) and note the Application (Client) ID, Directory (Tenant) ID, and a Client Secret value.
2. [Create a Data Collection Endpoint](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-data-collection-endpoint) and copy its Logs Ingestion URI (used as **Endpoint URL**).
3. [Create a table in your Log Analytics workspace](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/tutorial-logs-ingestion-portal#create-new-table-in-log-analytics-workspace), uploading a sample JSON array matching the data you'll ingest.
4. Choose a DCR mode — **manual** (supply the DCR's immutable **Rule ID**) or **managed** (supply the DCR's full ARM **DCR Resource ID**).

## Configuration

### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Endpoint URL | string | Yes | The Azure Monitor DCR ingestion endpoint URL. |
| Stream Name | string | Yes | The name of the data stream defined in the DCR. |
| DCR Configuration | one of | Yes | How the DCR is provided: `manual` or `managed`. |

**Manual** — `Rule ID` (string, required): the immutable identifier of the DCR.

**Managed** — `DCR Resource ID` (string, required): the full ARM resource ID of your DCR (`/subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Insights/dataCollectionRules/<name>`).

### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Tenant ID | string | Yes | The Azure Active Directory tenant (directory) ID. |
| Client ID | string | Yes | The application (client) ID registered in Azure Active Directory. |
| Client Secret | string | Yes | The client secret associated with the registered application in Azure AD. |

## Finding Your Configuration Values

- **Rule ID**: Monitor → Data Collection Rules → select your DCR → JSON View → `immutableId`.
- **DCR Resource ID**: Monitor → Data Collection Rules → select your DCR → JSON View → top-level `id`.
- **Stream Name**: follows the pattern `Custom-[TableName]_CL`. Find it under the DCR's `properties.streamDeclarations`, or add the `Custom-` prefix to your custom table name.

## Troubleshooting

- **Records rejected for size**: records above 1 MB are rejected — trim or split large records upstream.
- **Managed mode fails to set up a DCR**: confirm the application can read, create, and delete Data Collection Rules under the target subscription, and that the DCR Resource ID is valid.
- **Data not appearing**: verify the Stream Name matches a stream declared on the DCR and that the table schema matches the ingested records.

## Related Articles

[Azure Monitor Logs Ingestion API](https://learn.microsoft.com/en-us/azure/azure-monitor/logs/logs-ingestion-api-overview)