I often need to send logs to Log Analytics from a demo tenant which does not have Azure Subscription.
- (This guide and examples are also available at https://github.com/jsa2/AADmon2otherTenant)
✅ This guide is based on deep-diver-azure-ad-b2c-azure-monitor which is based on Azure AD B2C guide for similar use case
pre-reqs
- Azure Cloud shell (bash) – or suitable linux distribution and Azure CLI installed
Guide
In the AAD tenant where you want the logs to be redirected FROM
- Create group and take the note of the objectId
- Copy tenantId of the group
In The subscription where the logs will be redirected TO
- Create new RG and Log Analytics space, and take note of the resource group depl.sh
#Define starting variables
rnd=$RANDOM
autodg=redirectLogs-$rnd
rg=RG-redirectLogs-$rnd
location=westeurope
# Create Resource Group
az group create -n $rg \
-l $location \
--tags="svc=autoDiag"
az monitor log-analytics workspace create --location $location -g $rg -n laws${autodg}
- Populate redirectLogsParams.json with the values gathered in steps 1-2-3
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"mspOfferName": {
"value": "SecureCloudBlog AAD log redirect"
},
"rgName": {
"value": "rg-redirectlogs-11978"
},
"mspOfferDescription": {
"value": "Provide Azure Monitor for B2C resource"
},
"managedByTenantId": {
"value": "<✅tenantId"
},
"authorizations": {
"value": [
{
"principalId": "<✅GroupObjectId>",
"principalIdDisplayName": "Monitoring Contributor",
"roleDefinitionId": "749f88d5-cbae-40b8-bcfc-e573ddc772fa"
}
]
}
}
}
- Create the deployment
az deployment create --location $location --template-file redirectLogsTemplate.json --parameters @redirectLogsParams.json
In the AAD tenant where you want the logs to be redirected FROM
- Go to Azure AD and send the logs you want to be exported to the log analytics workspace and configure the export settings
https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Overview
SecureCloudBlog 
0 comments on “Create AAD Logs redirection from another tenant with Azure CLI in Bash”