Azure Event Hubs (Capture)
Entra sign-in logs, Entra audit logs and the Azure Activity log streamed to an Event Hub by a diagnostic setting and captured to a storage account. One configuration covers a whole tenant at the rate it actually produces events, with no Graph throttle.
- Connector id:
azure_event_hubs - Category: cloud
- Authentication: OAuth
Configuration
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
tenant_id | Entra tenant ID | string | yes | — | — |
client_id | Application (client) ID | string | yes | — | — |
client_secret | Client secret | secret | yes | — | encrypted at rest |
storage_account | Capture storage account name | string | yes | — | The storage account the Event Hub's Capture writes to (the account name alone, not a URL). |
container | Capture container / filesystem | string | yes | — | The blob container Capture is configured to write into. |
prefix | Path prefix | string | no | — | Optional. Narrow to one namespace or hub, e.g. 'contoso-ns/aisoc-hub'. Leave blank to read the whole container. |
client_secret is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API — a read of the saved connector shows the field as set, not its contents. See credential vault.
Setup
- In the console, go to Connectors → Add connector and pick Azure Event Hubs (Capture).
- Fill in the fields above and run Test connection. The test is read-only and does not save anything.
- Save. Polling starts on a jittered schedule within about a minute; the connector row shows
last_synconce the first poll completes.
last_sync stays emptyThe first poll is the honest signal that the credential works. A connector that saves cleanly and never syncs usually means the credential lacks a scope the vendor requires for reads — check the connectors service log for the vendor's own error, which is passed through verbatim rather than summarised.
Vendor-specific setup notes go here: which console page issues the credential, which scopes to grant, rate limits, and anything the schema cannot express. This section is preserved when the page is regenerated.