Before installing and configuring Azure Log Connector, several prerequisites must be in place in both your Microsoft Azure environment and your LT Auditor ^MP deployment. This article covers everything that needs to be confirmed or prepared before proceeding with installation.

LT Auditor ^MP prerequisites:

[Your administrator should confirm the exact download location for the Azure Log Connector package in your environment.]

Server requirements:

The machine where Azure Log Connector will be installed must meet the following requirements:

Required outbound network access:

Azure Log Connector requires outbound HTTPS access to the following Microsoft API endpoints. Confirm these are not blocked by your firewall or proxy:

Test connectivity from the Azure Log Connector server to each endpoint:

Test-NetConnection -ComputerName graph.microsoft.com -Port 443

Test-NetConnection -ComputerName manage.office.com -Port 443

Test-NetConnection -ComputerName login.microsoftonline.com -Port 443

All three should return a successful result. If any connection fails, work with your network team to allow outbound HTTPS traffic to those endpoints.

[Your administrator should confirm whether outbound internet access from the installation server requires proxy configuration, and if so, ensure the proxy settings are configured before proceeding.]

Microsoft Entra ID prerequisites:

Required API permissions:

The App Registration used by Azure Log Connector requires the following permissions. All permissions are Application type — not Delegated — as Azure Log Connector runs as a background service without a signed-in user. All permissions require Admin Consent from a Global Administrator.

Microsoft Graph — Application Permissions:

Office 365 Management APIs — Application Permissions:

This is a significantly broader set of permissions than the previous EntraConnector module required, reflecting the expanded scope of Azure Log Connector across both Entra ID and Microsoft 365. All permissions require Admin Consent before they become active.

Microsoft 365 license requirements:

Access to certain log categories requires appropriate Microsoft licensing. Confirm the following with your Microsoft licensing administrator:

[Your administrator should confirm your organization’s current Microsoft 365 and Entra ID license tiers and which log categories are available before configuring Azure Log Connector.]

Roles required for setup:

[Your administrator should coordinate with your Azure or Microsoft 365 administrator to complete the App Registration steps if they do not have access to the Azure Portal.]

Information to gather before installation:

Before proceeding to the App Registration and installation steps, gather the following. You will need all of these values during configuration:

The Client Secret value is only displayed once at the time of creation. Copy it immediately and store it securely. If the secret is lost, a new one must be generated.

Prerequisites checklist:

Before proceeding to the next article, confirm all of the following:

• [ ] Installation server meets Windows Server 2019 or newer requirement
• [ ] Outbound HTTPS access confirmed to all three Microsoft API endpoints
• [ ] LT Auditor ^MP server is installed and running
• [ ] LT Auditor ^MP syslog listener is active on the configured port
• [ ] Azure Portal access with appropriate privileges is available
• [ ] Microsoft 365 and Entra ID license tiers confirmed
• [ ] Tenant ID, Client ID, and Client Secret are ready to hand
• [ ] LT Auditor ^MP syslog port and protocol are confirmed

[Your administrator should complete this checklist before proceeding to the Registering the App in Microsoft Entra ID article to avoid interruptions during setup.]

Prerequisites:

Before installing, confirm the prerequisites checklist in the Prerequisites for Azure Log Connector article is complete, and that your App Registration in Microsoft Entra ID is fully configured with all required API permissions granted.

Step 1 — Run the installer:

Locate the installation package:

LTA_AzureLogCollector.msi

Right-click the MSI file and select Install. Follow the installation wizard prompts to complete the installation.

By default, the application installs to:

C:\Program Files\Blue Lance 2-0\LTA_AzureLogCollector

The installation process does not automatically start the LTA_AzureLogCollector Windows service. The service must be configured before it is started for the first time. Do not attempt to start the service until configuration is complete.

Step 2 — Run the configuration utility:

1. Open Command Prompt or PowerShell as Administrator
2. Navigate to the installation directory:

cd “C:\Program Files\Blue Lance 2-0\LTA_AzureLogCollector”

3. Run the configuration utility:

Lta.Entra.Agent.exe –configure

4. Enter the following information when prompted:

[Your administrator should confirm the correct Syslog Host, Port, and Protocol values for your LT Auditor ^MP environment before running the configuration utility.]

Step 3 — Start the service:

After configuration is complete, start the Windows service using one of the following methods:

Using the command line:

net start LTA_AzureLogCollector

Using the Services console:

1. Open Services (services.msc)
2. Locate LT Auditor ^MP Azure Log Collector
3. Click Start

Step 4 — Verify the service is running:

Confirm the service started successfully:

sc query LTA_AzureLogCollector

The service should show as Running. If the service fails to start, review the application logs for errors:

C:\Program Files\Blue Lance 2-0\LTA_AzureLogCollector\logs

Check for:

• Authentication failures — confirm Tenant ID, Client ID, and Client Secret are correct
• API permission errors — confirm Admin Consent has been granted for all permissions
• Network connectivity issues — confirm outbound HTTPS access to Microsoft API endpoints
• Syslog connection errors — confirm the LT Auditor ^MP server is reachable on the configured port

Step 5 — Verify events are arriving in LT Auditor ^MP:

After the service starts successfully:

1. Allow at least one polling cycle to complete (default: 5 minutes)
2. Log in to the LT Auditor ^MP Web UI
3. Navigate to View
4. Select the Azure Log Connector environment and category
5. Set the date range to Last Hour
6. Confirm that Azure log events are appearing in the event list

If no events appear after several polling cycles, refer to the verification and troubleshooting steps in the Configuring Polling Settings article.