Skip to main content

​
About Microsoft Azure Monitor

The Microsoft Azure Monitor source pulls diagnostic settings, subscription activity logs, metric and log alert rule configuration, and Log Analytics workspace settings from the connected subscription. Data is read through Azure Resource Manager with delegated OAuth as the signing-in user. Iru does not create or change diagnostic settings, alert rules, or workspaces. Activity log visibility follows Azure’s default retention (about 90 days at the subscription). Iru reads what Azure exposes for that window. For longer retention, export activity logs to a Log Analytics workspace or storage in Azure.

​
How It Works

Iru uses Microsoft’s OAuth 2.0 authorization code flow against Azure Resource Manager. The requested scope is: https://management.azure.com/user_impersonation
DetailValue
CategoryDeveloper tools
AuthenticationOAuth 2.0 (Microsoft Entra ID, Azure Resource Manager)
Vendor planAny Azure subscription

​
What Iru collects

Data typeNotes
Diagnostic settingsLog categories, retention, destinations (storage, event hub, Log Analytics)
Activity logsSubscription-level audit events (create, delete, policy, role changes, and similar)
Metric alert rulesDefinitions, thresholds, evaluation frequency
Log alert rulesScheduled query rules and activity log alert configuration
Log Analytics workspacesWorkspace configuration and data retention settings
Official references: Azure Monitor documentation, Diagnostic settings, Activity log, Roles and permissions, Diagnostic settings REST API.

​
Prerequisites

  • Microsoft Entra ID sign-in to the Azure portal.
  • The built-in Monitoring Reader role at subscription scope (or Reader, which includes the needed read paths). Monitoring Reader grants Microsoft.Insights/*/read for diagnostic settings, alert rules, and activity log access without write permissions.
  • Browser pop-ups allowed so the connector wizard can open when you enable the source.
Confirm access: Subscriptions → your subscription → Access control (IAM) → View my access. Example role assignment (replace placeholders): 
az role assignment create \
  --assignee <your-user-principal-name> \
  --role "Monitoring Reader" \
  --scope /subscriptions/<subscription-id>

​
Connect Microsoft Azure Monitor to Iru

Use Microsoft Azure first to confirm portal access and Monitoring Reader (or Reader) coverage, then complete OAuth in Iru Compliance. The wizard shows Step 1 of 1: Perform OAuth Authentication.
Complete this tab before you start OAuth in Iru Compliance.
1

Sign in to the Azure portal

Open portal.azure.com and sign in with the account you will use in the Iru wizard.
2

Open your target subscription

Search for Subscriptions, then open the subscription whose Monitor diagnostics and metrics Iru should read.
3

Verify Monitoring Reader or Reader access

Open Access control (IAM) → View my access. Confirm Monitoring Reader or subscription Reader, per Prerequisites.
4

Allow pop-ups in your browser

Allow pop-ups for your Iru hostname so the Microsoft consent window can open.
5

Plan for the right Entra tenant

If you use multiple tenants, use a clean browser session so OAuth signs in to the tenant that owns the subscription.
Continue on the Iru Compliance tab.

​
Troubleshooting

Check pop-up blocker settings for the Iru site and try again.
The signed-in account may lack Monitoring Reader (or Reader) at subscription scope. Verify IAM (see Prerequisites).
Azure retains subscription activity logs for about 90 days by default. Iru reflects what is available in that window unless you have extended retention via export to Log Analytics or storage.
Sign out of the Microsoft pop-up and sign in with the account for the correct tenant.
Turn Microsoft Azure Monitor off and on in Sources, then complete OAuth again.

Sources Management

Browse and manage every Compliance source.

Getting Started With Compliance

Frameworks, actions, and Artifacts.

Iru Overview

How Endpoint, Compliance, and Identity fit together.

Artifacts Management

Upload, review, and organize evidence from sources and actions.