Azure Sentinel P1/P2 license

Question

question

Eduards-6654 asked Sep 30, '21 Eduards-6654 commented Sep 30, '21

Azure Sentinel P1/P2 license

Hello,

I have question about Azure P1/P2 licensing for Azure sentinel

For example I have Azure Sentinel and Azure AD data connector but i only could collect Audit logs.

For Azure AD Sign-in collecting I need P1/P2 license.

How many license I should buy to use this feature?

Could I buy 1 license and cover all Azure Sentinel features with this license or I need to buy as many license as I have endpoints?

What would be your recommendation? I don't have any information on Microsoft sites about this.

Thank you!

microsoft-sentinel

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2021-09-30T13:27:25.127Z

sbairu answered Sep 30, '21 Eduards-6654 commented Sep 30, '21

HI @Eduards-6654

There's really no licensing for Azure Sentinel itself. Instead, make sure your licensing for the services that contain the data you want to connect to Azure Sentinel is licensed appropriately. For example, to export sign-in data from Azure AD, you need an Azure AD P1 or P2 license. So, at minimum, you would want Microsoft 365 E3 which includes P1.

information:https://azure.microsoft.com/en-us/pricing/details/azure-sentinel/

if my answer is helpful please accept my answer

Thanks & Regards,
Sarat chandra

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Eduards-6654 · Sep 30, 2021 at 01:31 PM

Ok, thank you!

0 ·

Answer 2 · 2021-09-30T13:08:48.23Z

vipulsparsh-MSFT answered Sep 30, '21

@Eduards-6654 Azure AD P1/P2 license comes per user. For Sentinel to be able to get the Sign-In logs you will need to Assign P1 or P2 license per user.
The logic is you will be able to send logs for those users who have p1 or P2 enabled for them.

Other features under P2 would have been available for whole organization even while not assigning P1 or P2 for everyone.
But in Sentinel scenario, you get the sign in logs for users who are License enabled.

Let me know if you have any questions.

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2021-09-30T13:17:26.133Z

Eduards-6654 answered Sep 30, '21

Hello @vipulsparsh-MSFT is there somewhere documentation of this with link?

Thank you!

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question