Control: Azure > CIS v5.0 > 6 - Management and Governance Services > 6.01 - Logging and Monitoring > 6.01.01 - Configuring Diagnostic Settings > 6.01.01.08 - Ensure that a Microsoft Entra diagnostic setting exists to send Microsoft Graph activity logs to an appropriate destination

Configures auditing against a CIS Benchmark item.

Level: 2

Ensure that Microsoft Entra ID Graph activity logs are integrated with Azure Monitor for centralized logging and analysis.

Microsoft Graph logs provide visibility into activity performed through the Microsoft Graph API, including operations on Entra ID resources. These logs are essential for security monitoring and incident response as they capture API-level operations that may not be visible in standard Entra ID audit logs.

Resource Types

This control targets the following resource types:

Azure > Active Directory > Directory

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/azure-cisv5-0#/control/types/r06010108

Category URI

tmod:@turbot/cis#/control/categories/v070602

GraphQL

query controlType(id: "tmod:@turbot/azure-cisv5-0#/control/types/r06010108") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/azure-cisv5-0#/control/types/r06010108'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/azure-cisv5-0#/control/types/r06010108"