Azure Monitor Logs is a service that collects and organizes log and performance data from monitored resources. Once logs are collected into Azure Monitor Logs, they can be used to create dashboards, alerts, and saved queries. Azure Monitor Logs is the backend store for Azure Monitor Workbooks, Azure Monitor Alerts, and Azure Monitor Application Insights.

To ingest logs into Azure Monitor Logs or Microsoft Sentinel, you must perform the following steps:

  1. Create an Data Collection Endpoint (DCE).
  2. Create a Data Collection Rule (DCR) in the log analytics workspace.
  3. Create an app registration and generate a secret for the DCE.
  4. Grant the app registration appropriate permissions.

This process is documented in detail in the Microsoft documentation.

Connecting to Microsoft Sentinel

Once the data is ingested to the log analytics workspace, you can import it into Microsoft Sentinel.