---
title: "Microsoft AMA Log Analytics"
slug: "microsoft-ama-log-analytics"
updated: 2025-07-06T20:19:57Z
published: 2025-07-06T20:19:57Z
canonical: "docs.databee.buzz/microsoft-ama-log-analytics"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft AMA Log Analytics

The Azure Monitor Agent collects monitoring data from the guest operating system of Azure and hybrid virtual machines (VMs). It delivers the data to Azure Monitor for use by features, insights, and other services, such as Microsoft Sentinel and Microsoft Defender for Cloud. Refer to [Azure Monitor Agent](https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview) for more information.

**Integration Method:** API

**Tables:** DNS Activity (4003), Detection Finding (2004)

This integration supports the following events.

| **Event** | **Description** |
| --- | --- |
| DNS Logs | Return DNS audit and activity in azure. |

This integration supports the following versions.

| Log analytics API version supported | v1.0 |
| --- | --- |

> [!NOTE]
> **Note:**
> 
> Log analytics doesn’t follow a traditional versioning system. Instead, it is a continuously updated cloud service. Please find more details [here](https://azure.microsoft.com/en-us/updates/?category=management-tools&filters=%5B%22Azure+Monitor%22%5D).

## Prerequisites

- The user requires at least Global Administrator privilege to create and manage applications in Azure Cloud.
- The user should have access to the DataBee platform.

## Configuration Overview

1. Create an application with required permissions to fetch the data.
2. Add Endpoint Access to the Application created.
3. Add role to the Log Analytics Workspace.
4. Add [Microsoft AMA](/user-manual/docs/microsoft-ama-log-analytics#databee-configuration) in the DataBee console with the below parameter.

| **DataBee Feed Parameter** | **Azure Parameter** |
| --- | --- |
| Workspace ID | [Workspace ID](/user-manual/docs/microsoft-ama-log-analytics#workspace-configuration) |
| Client Key | [Application (Client) ID](/user-manual/docs/microsoft-ama-log-analytics#create-an-application) |
| Client Secret | [Client Secret](/user-manual/docs/microsoft-ama-log-analytics#create-the-client-secret) |
| Token URL(<application_id>) | [Directory (tenant) ID](/user-manual/docs/microsoft-ama-log-analytics#create-an-application) |

## Azure Configuration

### Create an application

1. Log on to [Azure portal](https://portal.azure.com/) with an account that has the Global Administrator privileges.
2. In the search bar, search for **App Registrations** and select it. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-rotv5qsb.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
3. On the “App registrations” page, click on **New registration.** The “Register an application” window will appear. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-mmstnnnh.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
4. On the “Register an application” window:
  - Under ‘Name’ enter your application name then click on **Register** to create the application.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-3jms8jb9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
5. On the app **Overview** page, copy the **Application (client) ID** and **Directory (tenant) ID** for later use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-xn3wrm8l.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)

### Add Endpoint Access

Once the application is created, appropriate permissions should be provided in order to fetch data. The appropriate permissions for the application are needed to access these endpoints. The following section details how to configure and add permissions to the required endpoints.

#### Add Permissions

To add permissions for the endpoint outlined above, from the **Azure Active Directory portal**:

1. Select the application registered in the previous step.
2. Under **Manage,** click **API Permissions** and then click **Add a Permission,** the “Request API permissions” window will appear. Go to **APIs my organization uses** > Search for the **“Log analytics API”** and select the **Log Analytics API.** ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-90rg6m7v.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
3. Click on **Log Analytics API** then select **Delegated Permissions** as Permission type.

| **Event** | **Type** | **Permission** |
| --- | --- | --- |
| DNS Logs | Delegated | Data.Read |

1. Click the **Add permissions** button after selecting all required permissions. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-sd06n5t9.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
2. On the “API permissions” page,

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-lbmn8ahn.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
  1. Click **Grant Admin Consent** **for <tenant>**.
  2. Click the **Yes** button on the consent confirmation.
3. The required permissions are now added for the endpoints. Overall permission looks like this and makes sure that type is an application for all. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-o1hq9868.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)

## Workspace configuration

Now our app has permissions to use API, and our app needs access to the Log Analytics workspace.

1. Search for **Log Analytics workspaces** as shown below. Go to Log Analytics workspace in which the AMA is configured. ![Picture 545248431, Picture](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-7rhrvmtk.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
2. Go to your **Workspace** and then save **workspace ID** for future use ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-tbg35d6v.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
3. From the left tab menu, Select **Access control (IAM)** > Select **Add role assignment.** ![Picture 1632734000, Picture](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-3oueni6m.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
4. Select the **Reader** role and then click on **Next**. ![Picture 1929228628, Picture](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-etvf2k4t.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
5. On the **Members** tab, choose **Select members**. Enter the name of your app in the Select box. Select your app and choose Select. Select **Review + assign**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-jova2g6r.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)

> [!NOTE]
> Note:
> 
> For more details on the steps above. Please refer documentation.

### Create the client secret

The final step to accessing the APIs is creating a **Client Secret**. To create it from the Azure Portal:

1. Select the application created above.
2. Under **Manage**, Click **Certificates and Secrets**, and then **Client Secrets**.

![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-fg1ptxuz.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
3. Click **New client secret**. Then “Add a client secret” window appears. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-mjrchyei.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
4. On “Add a client secret” window:
  1. Enter a ‘Description’ for this client secret and select the desired expiry period from the ‘Expires’ drop-list.
  2. Then click on **Add** to create the client's secret. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-67i6978z.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
5. Save **Client Secret** for future use. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-9jgvgnnb.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)

> [!NOTE]
> Note:
> 
> The user needs to re-create the client secret when it expires.

## DataBee Configuration

1. Login to the DataBee UI, navigate to **Data** > **Data Feeds** and click the **Add New Data Feed** button. ![Inserting image..., Picture](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-ybjo290b.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
2. Search for the **Microsoft AMA** and click it as shown below. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-7klb4t5p.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
3. Click on the **API Ingest** option for collection method. ![Inserting image..., Picture](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-6wp0y1jd.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
4. Enter feed contact information and click **Next**. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-c2ygjfve.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
5. In the configuration page, enter the following
  - Authentication Method: OAuth2
  - Client Key: Client ID found on the application overview page.
  - Client Secret: [Client Secret](/docs/microsoft-ama-log-analytics#client_secret) generated for the application.
  - Token URL: replace/Update the Tenant ID found on the application overview page.
  - API Base URL: keep the default API Base URL
  - Event Types: preselected for all the event types that integration pulls
  - Workspace ID: provide Workspace ID for the application. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/microsoft-ama-image-2x42fpzz.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A35%3A01Z&se=2026-10-30T12%3A35%3A01Z&sr=c&sp=r&sig=OsnDPByMnz3aALZRdPfwiBHryqTm1Rx92IETIOc9vyg%3D)
6. Click **Submit**.

## Troubleshooting Tips

- Ensure the token is pasted correctly. Since you cannot view the token after the 1st time, re-create the token, paste it on a text editor to ensure no spaces or unexpected characters are included and reconfigure the DataBee feed.
- Ensure that the application has the necessary permissions as mentioned in the document.

#