Microsoft Entra ID Protection
TroubleshootingHowto Export Risk Data
In brief
The page now distinguishes diagnostic setting categories from KQL table names and maps six ID Protection signals to their corresponding AAD-prefixed Log Analytics tables.
What Entra admins need to know
Use the diagnostic category when enabling export and the mapped table name when writing KQL queries.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
You need to configure a Log Analytics workspace before you can export and then query the data. Once you configured a Log Analytics workspace and exported the data with diagnostic settings, go to Microsoft Entra admin center > Entra ID > Monitoring & health > Log Analytics. Then, with Log Analytics, you can query data using built-in or custom Kusto queries.
The following tables are of most interest to Microsoft Entra ID Protection administrators:
RiskyUsers - Provides data like theRisky usersreport.UserRiskEvents - Provides data like theDiagnostic setting categories vs Log Analytics table names
Use this mapping when you enable export and when you write queries:
Report / signal Diagnostic setting category (enable export) Log Analytics table name (use in queries) Table reference Risky users RiskyUsersAADRiskyUsersAADRiskyUsers Risk detections report.RiskyServicePrincipals - Provides data like the(users)UserRiskEventsAADUserRiskEventsAADUserRiskEvents Risky workload identities report.ServicePrincipalRiskEvents - Provides data like theRiskyServicePrincipalsAADRiskyServicePrincipalsAADRiskyServicePrincipals Workload identity detections report.RiskyAgents - Provides data like theServicePrincipalRiskEventsAADServicePrincipalRiskEventsAADServicePrincipalRiskEvents Risky agents report.AgentRiskEvents - Provides data like theRiskyAgentsAADRiskyAgentsAADRiskyAgents Agent identity detections report.AgentRiskEventsAADAgentRiskEventsAADAgentRiskEvents
@@ -55,14 +55,24 @@ Integrating risk data with Log Analytics provides robust data analysis and visua You need to configure a Log Analytics workspace before you can export and then query the data. Once you configured a Log Analytics workspace and exported the data with diagnostic settings, go to [Microsoft Entra admin center](https://entra.microsoft.com) > **Entra ID** > **Monitoring & health** > **Log Analytics**. Then, with Log Analytics, you can query data using built-in or custom Kusto queries. -The following tables are of most interest to Microsoft Entra ID Protection administrators:--- RiskyUsers - Provides data like the **Risky users** report.-- UserRiskEvents - Provides data like the **Risk detections** report.-- RiskyServicePrincipals - Provides data like the **Risky workload identities** report.-- ServicePrincipalRiskEvents - Provides data like the **Workload identity detections** report.-- RiskyAgents - Provides data like the **Risky agents** report.-- AgentRiskEvents - Provides data like the **Agent identity detections** report.+> [!IMPORTANT]+> The names you select in **diagnostic settings** are not the same as the **table names** you use in Kusto (KQL) queries.+> - **Diagnostic setting category** = what you enable for export+> - **Log Analytics table name** = what you query (usually prefixed with `AAD`)++### Diagnostic setting categories vs Log Analytics table names++Use this mapping when you enable export and when you write queries:++| Report / signal | Diagnostic setting category (enable export) | Log Analytics table name (use in queries) | Table reference |+| --- | --- | --- | --- |+| Risky users | `RiskyUsers` | `AADRiskyUsers` | [AADRiskyUsers](/azure/azure-monitor/reference/tables/aadriskyusers) |+| Risk detections (users) | `UserRiskEvents` | `AADUserRiskEvents` | [AADUserRiskEvents](/azure/azure-monitor/reference/tables/aaduserriskevents) |+| Risky workload identities | `RiskyServicePrincipals` | `AADRiskyServicePrincipals` | [AADRiskyServicePrincipals](/azure/azure-monitor/reference/tables/aadriskyserviceprincipals) |+| Workload identity detections | `ServicePrincipalRiskEvents` | `AADServicePrincipalRiskEvents` | [AADServicePrincipalRiskEvents](/azure/azure-monitor/reference/tables/aadserviceprincipalriskevents) |+| Risky agents | `RiskyAgents` | `AADRiskyAgents` | [AADRiskyAgents](/azure/azure-monitor/reference/tables/aadriskyagents) |+| Agent identity detections | `AgentRiskEvents` | `AADAgentRiskEvents` | [AADAgentRiskEvents](/azure/azure-monitor/reference/tables/aadagentriskevents) |+ > [!NOTE] > Log Analytics only has visibility into data as it is streamed. Events prior to enabling the sending of events from Microsoft Entra ID don't appear.