This article will demonstrate how to enable and configure Diagnostic logging from all storage services within the Azure Storage Account - Blob, Queue, Table, and File into your Microsoft Sentinel workspace at scale, allowing you to continuously monitor activity in all your instances and detect malicious activity in your organization. A common theme in cloud environments is enforcing organizational standards and adopting cloud governance since day one.

Azure Storage has evolved rapidly, and I’m excited to announce that my Azure Storage Essential Training course on LinkedIn Learning has been fully updated (released October 2025). This 3h56m intermediate-level course still covers the fundamentals of Azure Storage (Blobs, Files, Queues) with hands-on demos, but now includes the latest features and best practices. We’ll explore new capabilities like built-in SFTP for Blob Storage, serverless automation with Azure Storage Actions, and advanced security options.

Microsoft Sentinel’s Codeless Connector Framework (CCF) empowers you to build custom data connectors for any SaaS application without writing code. Instead of deploying and managing Azure Functions or Logic Apps, CCF lets you ingest data via a fully managed, SaaS-based polling service. Connectors built with CCF require no infrastructure (no VMs, no function apps) and benefit from out-of-the-box health monitoring and Microsoft support.

Modern SIEM and platform solutions like Microsoft Sentinel can ingest logs from virtually any source, including custom text and JSON logs from network appliances and applications, and land them in your Sentinel data lake for scalable analytics. In this guide, we walk through configuring a FortiGate firewall (as an example) to forward logs to an Azure Arc-enabled Linux syslog server, using the Azure Monitor Agent (AMA) to read a custom log file and ingest it into a Log Analytics workspace (and thus into Sentinel).