Identity Defense Collects Limited Entra ID Events and No Sign-In Events When Basic-Collector Enterprise Application Permissions Are Not Granted (4384088)

A customer configured Identity Defense and:

• Added the Microsoft Entra ID tenant.
• Granted permissions to the following Enterprise Applications:
  • Core-Basic
  • Audit-Basic
• Enabled:
  • Collect Entra Events
  • Collect Sign-In Events

However:

• Only a limited number of Entra ID events are collected.
• No Sign-In events are visible.
• The issue occurs in production, while a pre-production environment successfully collects all events.

The key configuration difference between the environments is that the Basic-Collector Enterprise Application permissions were granted in pre-production but not in production.

The Basic-Collector Enterprise Application is responsible for accessing and collecting Microsoft Entra ID audit and Sign-In event data.

If the required Microsoft Graph permissions are not granted and consented, Identity Defense may be unable to retrieve the full event set, resulting in:

• Missing Sign-In events.
• Partial audit event collection.
• Incomplete visibility into Entra ID activity.

This behavior can occur regardless of whether the customer is using the legacy ODA licensing model integrated into Identity Defense.

Grant the required permissions to the Basic-Collector Enterprise Application and ensure administrative consent has been completed.

Steps

1. Open the Microsoft Entra Admin Center.
2. Navigate to Enterprise Applications.
3. Locate the Basic-Collector Enterprise Application.
4. Review the API permissions assigned to the application.
5. Grant any required permissions that are missing.
6. Ensure Admin Consent has been granted for all required permissions.
7. Allow sufficient time for event ingestion and verify event collection within Identity Defense.