Before installing and configuring Azure Log Connector, several prerequisites must be in place in both your Microsoft Azure environment and your LT Auditor ^MP deployment. This article covers everything that needs to be confirmed or prepared before proceeding with installation.

LT Auditor ^MP prerequisites:

[Your administrator should confirm the exact download location for the Azure Log Connector package in your environment.]

Server requirements:

The machine where Azure Log Connector will be installed must meet the following requirements:

Required outbound network access:

Azure Log Connector requires outbound HTTPS access to the following Microsoft API endpoints. Confirm these are not blocked by your firewall or proxy:

Test connectivity from the Azure Log Connector server to each endpoint:

Test-NetConnection -ComputerName graph.microsoft.com -Port 443

Test-NetConnection -ComputerName manage.office.com -Port 443

Test-NetConnection -ComputerName login.microsoftonline.com -Port 443

All three should return a successful result. If any connection fails, work with your network team to allow outbound HTTPS traffic to those endpoints.

[Your administrator should confirm whether outbound internet access from the installation server requires proxy configuration, and if so, ensure the proxy settings are configured before proceeding.]

Microsoft Entra ID prerequisites:

Required API permissions:

The App Registration used by Azure Log Connector requires the following permissions. All permissions are Application type — not Delegated — as Azure Log Connector runs as a background service without a signed-in user. All permissions require Admin Consent from a Global Administrator.

Microsoft Graph — Application Permissions:

Office 365 Management APIs — Application Permissions:

This is a significantly broader set of permissions than the previous EntraConnector module required, reflecting the expanded scope of Azure Log Connector across both Entra ID and Microsoft 365. All permissions require Admin Consent before they become active.

Microsoft 365 license requirements:

Access to certain log categories requires appropriate Microsoft licensing. Confirm the following with your Microsoft licensing administrator:

[Your administrator should confirm your organization’s current Microsoft 365 and Entra ID license tiers and which log categories are available before configuring Azure Log Connector.]

Roles required for setup:

[Your administrator should coordinate with your Azure or Microsoft 365 administrator to complete the App Registration steps if they do not have access to the Azure Portal.]

Information to gather before installation:

Before proceeding to the App Registration and installation steps, gather the following. You will need all of these values during configuration:

The Client Secret value is only displayed once at the time of creation. Copy it immediately and store it securely. If the secret is lost, a new one must be generated.

Prerequisites checklist:

Before proceeding to the next article, confirm all of the following:

• [ ] Installation server meets Windows Server 2019 or newer requirement
• [ ] Outbound HTTPS access confirmed to all three Microsoft API endpoints
• [ ] LT Auditor ^MP server is installed and running
• [ ] LT Auditor ^MP syslog listener is active on the configured port
• [ ] Azure Portal access with appropriate privileges is available
• [ ] Microsoft 365 and Entra ID license tiers confirmed
• [ ] Tenant ID, Client ID, and Client Secret are ready to hand
• [ ] LT Auditor ^MP syslog port and protocol are confirmed

[Your administrator should complete this checklist before proceeding to the Registering the App in Microsoft Entra ID article to avoid interruptions during setup.]

Before you begin:

• Confirm your OS meets the requirements listed in Supported Operating Systems
• Confirm required ports are available and not blocked by your firewall
• Have your server’s actual IP address or domain name ready — do not use 127.0.0.1

Installation steps:

1. Open PowerShell as Administrator and navigate to the Windows directory:

cd Windows

2. Allow PowerShell scripts to run:

Set-ExecutionPolicy Unrestricted

3. Run the installation script:

.\Install.ps1

4. Follow any on-screen instructions, including accepting the EULA when prompted.
   
5. Once installation is complete, reset the PowerShell execution policy:
   

Set-ExecutionPolicy Restricted

Always reset the execution policy after installation is complete as a security best practice.

[Your administrator should note here where the installation package is obtained and any environment-specific options that appear during installation.]

Before you begin:

• Confirm your OS meets the requirements listed in Supported Operating Systems
• Confirm required ports are available and not blocked by your firewall
• Have your server’s actual IP address or domain name ready — do not use 127.0.0.1

Installation steps:

1. Navigate to the scripts directory:

cd scripts

2. Switch to superuser mode:

sudo su

3. Make all scripts executable:

chmod +x *.sh

4. Run the installation script:

./install.sh

5. Follow any on-screen instructions, including accepting the EULA when prompted.

[Your administrator should note here where the installation package is obtained and any environment-specific options that appear during installation.]

Installation cannot proceed without accepting the EULA.

Linux:

• SLES 15 or newer
• Ubuntu 22.04 LTS or newer
• Debian 12 or newer

Windows:

• Windows Server 2019 or newer

Your administrator should confirm exact RAM, disk, and network port requirements for your specific deployment.