Office365 Conditional Access

[Asmit Desai]

Hi Team,

I have a question based on the monitoring of Conditional Access on Wazuh. I monitor the entire O365 wodle, but the Conditional Access logs don't show any user-triggered Conditional Access events — only the Conditional Access changes made by service accounts attached to my tenant. Is there something I am doing wrong, or is this an issue with Wazuh? I would appreciate your help in this matter.

Regards,
Asmit Desai

[raul....@wazuh.com]

Hi, 
The O365 wodle ingests data from the Office 365 Management Activity API. Within that API, Azure AD-related events fall under the Audit.AzureActiveDirectory content type, which only captures administrative/audit events — things like policy creation, updates, or changes made by admins or service principals. That's exactly what you're seeing: Conditional Access changes triggered by service accounts.
What you're looking for — Conditional Access evaluation results tied to individual user sign-ins (which policy was evaluated, whether MFA/device compliance was satisfied, etc.) — lives in a different data source entirely: Azure AD Sign-in logs. These are exposed via Microsoft Graph API or via Azure Monitor (Log Analytics/Event Hub), not through the Management Activity API that the O365 wodle consumes. So there's no way to get sign-in-level Conditional Access data through the O365 wodle alone.
To capture that data, you'll need to:
1. Enable Diagnostic Settings in Azure AD (Entra ID) to export Sign-in logs to a Log Analytics Workspace or Event Hub.
2. Use Wazuh's Azure module (a separate wodle from O365) to ingest those logs from Log Analytics/Event Hub.
3. Confirm you have Azure AD P1/P2 licensing, which is required for full Sign-in log detail including Conditional Access results.

  I’m sharing detailed information about the Azure components and services that can be monitored using Wazuh. This reference will help you validate which elements can be integrated and what type of telemetry can be collected from the platform. If you need us to expand on any specific area or prepare an integration guide, I’ll be happy to assist.

  
https://documentation.wazuh.com/current/cloud-security/azure/index.html