Challenges in Azure Log Monitoring: Insights for Your SOC by Dmitriy Beryoza

This report analyzes systemic weaknesses in Microsoft cloud logging across Entra ID (Azure AD), Microsoft 365, and Azure resources that impede detection and response, including outages and ingestion delays, paywalled telemetry ("logging tax"), unlogged reconnaissance, inconsistent IDs/IPs/geolocation/device data, schema drift, missing and broken events, and unannounced changes. It describes how these issues create investigation blind spots and enable attacker evasion, and recommends that defenders continuously verify log flow and completeness, craft resilient queries favoring stable identifiers, and press vendors for timely, consistent, and well-documented telemetry.