Entra ID audit logs to CrowdStrike SIEM, one stream per country
- The problem
- One tenant, many countries, and every security team allowed to see only its own events.
- What I built
- Event Hubs, Stream Analytics and a runbook-maintained user-to-country lookup feeding CrowdStrike per country.
- What came of it
- Each country measurable on its own; users without a country become a worklist, not a guess.
A multi-country group with one tenant has one stream of sign-in and audit logs, and a security team per country that needs its slice of it, and only its slice. Legal wants it that way, the country security leads want it that way, and a single global SIEM that everyone can read is the thing nobody wants.
The catch: an Entra ID sign-in event doesn’t say which country the user belongs to. It says who, from where, to what. Country is a property of the user, and it lives in the directory.
The pipeline
Entra ID’s diagnostic settings stream sign-in and audit logs into an Event Hub. A Stream Analytics job reads that stream, joins each event against a small reference table, user → country, and writes it to the CrowdStrike NG-SIEM collector of that country. The table lives in blob storage and is refreshed on a schedule by an Azure Automation runbook that reads the directory with a managed identity: no stored credentials, no certificate to rotate.
The interesting part is the rule the runbook applies when deciding a country, because the directory is never fully tidy:
The business-unit attribute, if set: that’s the organisation’s own answer.
Otherwise the usage location: where the licence says the person works.
Otherwise nothing. The user is dropped from routing.
Each country as a unit
Filtering was the requirement; measurement was the point. Once every event carries a country, each country becomes a unit you can put a number on: how many sign-ins, how many failures, how many risky ones, how many privileged operations, and how those move month to month. A security lead in one country sees their own picture, and the group can compare countries on the same scale instead of guessing from a global total.
The number that matters
Because unmatched users are dropped, the metric to watch isn’t how many events were routed but how many users have no country. That count is reported with every refresh, and it’s the to-do list for the identity team: every name on it is a directory record to fix. Routed events are the outcome; dropped users are the work.