question

Eduards-6654 avatar image
0 Votes"
Eduards-6654 asked Eduards-6654 commented

Azure Sentinel P1/P2 license

Hello,

I have question about Azure P1/P2 licensing for Azure sentinel

For example I have Azure Sentinel and Azure AD data connector but i only could collect Audit logs.

For Azure AD Sign-in collecting I need P1/P2 license.

How many license I should buy to use this feature?

Could I buy 1 license and cover all Azure Sentinel features with this license or I need to buy as many license as I have endpoints?

What would be your recommendation? I don't have any information on Microsoft sites about this.

Thank you!

azure-sentinel
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

sbairu avatar image
0 Votes"
sbairu answered Eduards-6654 commented

HI @Eduards-6654

There's really no licensing for Azure Sentinel itself. Instead, make sure your licensing for the services that contain the data you want to connect to Azure Sentinel is licensed appropriately. For example, to export sign-in data from Azure AD, you need an Azure AD P1 or P2 license. So, at minimum, you would want Microsoft 365 E3 which includes P1.

information:https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/


if my answer is helpful please accept my answer

Thanks & Regards,
Sarat chandra

· 1
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Ok, thank you!

0 Votes 0 ·
vipulsparsh-MSFT avatar image
0 Votes"
vipulsparsh-MSFT answered

@Eduards-6654 Azure AD P1/P2 license comes per user. For Sentinel to be able to get the Sign-In logs you will need to Assign P1 or P2 license per user.
The logic is you will be able to send logs for those users who have p1 or P2 enabled for them.

Other features under P2 would have been available for whole organization even while not assigning P1 or P2 for everyone.
But in Sentinel scenario, you get the sign in logs for users who are License enabled.

Let me know if you have any questions.



Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Eduards-6654 avatar image
0 Votes"
Eduards-6654 answered

Hello @vipulsparsh-MSFT is there somewhere documentation of this with link?

Thank you!

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.