SYSTEM NOTICE

Auto translation by AI. Be sure, accuracy, nuances and authorial intent may not be fully reflected.

Practical Guide to Log Retention, Responsibility Boundaries, and Audit Trails to Decide Before Implementing Microsoft Sentinel

山崎行政書士事務所　クラウド法務担当

Microsoft Sentinel is a critical foundation that supports log auditing, threat detection, and incident response in the cloud era.

However, simply implementing Sentinel does not automatically complete your audit or incident response capabilities.
In practice, the real issues often arise after implementation.

“We are collecting logs, but we cannot output them in the format required for audits.”
“It is unclear who is contractually responsible for initial triage during outages or unauthorized access.”
“Retention periods were decided solely by the IT department and are not aligned with contracts, regulations, or personal information protection policies.”
“The legal department is unaware of the scope of log access granted to SOC vendors, subcontractors, and overseas support teams.”

In this state, even if Sentinel is a powerful SIEM, it will not serve as an evidentiary foundation that can be explained to management, the legal department, or internal audit teams.

This article explains the practical approach to organizing Microsoft Sentinel, Azure technical design, cloud contracts, personal information protection, and security standards like NIST and ISMS in a single framework.

The conclusion is clear.

When implementing Microsoft Sentinel, you must define log retention policies, responsibility boundaries, and rules for submitting evidence in contracts and regulations before configuring analysis rules.

The IT department designs the Log Analytics Workspace, data connectors, diagnostic settings, Azure Policy, RBAC, KQL, retention periods, and costs.
The legal department confirms SLAs, outage notifications, subcontracting, audit rights, log provision, data return/deletion, and the handling of personal and confidential information.
Management determines which risks to accept and which risks to mitigate through technology, contracts, outsourcing, and audits.

Microsoft Learn describes Sentinel as a cloud-native SIEM that supports threat detection, investigation, response, and hunting in multi-cloud and multi-platform environments.
It also explains that Sentinel is a mechanism for ingesting data using data connectors, and that it supports external data integration using Syslog, CEF, REST APIs, and more, in addition to Microsoft services.

In other words, implementing Sentinel is not just a “log collection configuration task.”
In practice, it is a project that integrates the design of IDs, permissions, logs, contracts, vendors, cross-border transfers, and audit trails.

4. Why this topic is important now

Common failures in the field

The following are common failures that occur in environments where Sentinel or Azure Monitor have been implemented.

Field Failures | Technical Causes | Legal/Audit Issues | Insufficient logs | Resources excluded from diagnostic settings | Lack of evidence during incidents | Logs not retained | Retention period left at default | Failure to meet audit/contractual requirements | Logs exist but cannot be output | KQL/output procedures are siloed | Delays in audit submissions or explanations to business partners | Too many alerts | Insufficient tuning of analysis rules | Leads to overlooking major incidents | Unclear who is responsible for response | Unorganized division of labor between SOC, IT, and cloud providers | Ambiguous outage notifications, breach response, and responsibility boundaries | Unaware of overseas access | Unconfirmed support locations/SOC locations | Insufficient confirmation of Personal Information Protection Act, GDPR, and contracts

Regarding Azure Activity Logs, Microsoft Learn explains that events are deleted after 90 days, and if long-term retention is required, they must be sent to another location via diagnostic settings.
Official information confirms that Azure Monitor diagnostic settings can be created via the portal, PowerShell, CLI, ARM, Bicep, and REST APIs.

The practical takeaway from this is that log retention periods are not something to think about later, but must be decided during the design phase in alignment with contracts, regulations, and audit requirements.

Issues difficult for the IT department to resolve alone

While the IT department may be strong in log ingestion, KQL, alerts, RBAC, costs, and Azure Policy, it is difficult for them to judge the following points on their own.

  • Within how many days should outages or incidents be notified according to the contract?

  • How should the scope and format of log submissions be defined in the contract?

  • How to determine retention periods for logs containing personal information or trade secrets

  • How to record log access by SOC contractors and subcontractors

  • How to verify the existence of cross-border data transfers or overseas support

Technical issues that are difficult for the legal department to judge alone

On the other hand, it is difficult for the legal department alone to make the following judgments.

  • Differences between Entra ID sign-in logs and audit logs

  • Differences between Azure Activity Logs and resource logs

  • Retention settings for Log Analytics Workspaces

  • How to distinguish between logs sent to Sentinel and logs stored long-term in Storage

  • The scope of diagnostic settings that can be enforced via Azure Policy

  • RBAC permissions required by the SOC

  • Whether audit trails can actually be extracted using KQL

Risk acceptance that management should decide

Management should look at more than just product implementation costs.

  • Which systems should be prioritized for monitoring

  • How long logs should be retained

  • How much to spend on SOC outsourcing

  • To what extent accountability will be fulfilled in the event of a major incident

  • Whether to leverage investments for client audits, bidding, and ISMS compliance

  • Which business operations to prioritize for recovery in the event of a failure

In the Microsoft Cloud Security Benchmark, logging and threat detection are also organized as controls that include enabling, collecting, and storing cloud service audit logs, centralized analysis via SIEM, time synchronization, and log retention.

5. Technical Practical Points

Target Services

This article covers the following services.

  • Microsoft Sentinel

  • Log Analytics Workspace

  • Azure Monitor

  • Azure Activity Log

  • Diagnostic settings

  • Microsoft Entra ID

  • Conditional Access

  • Privileged Identity Management

  • Azure RBAC

  • Azure Policy

  • Microsoft Defender for Cloud

  • Microsoft Purview

  • Key Vault

  • Private Endpoint

  • NSG

  • Azure Firewall

  • Azure Backup

  • Storage Account

  • Event Hubs

  • Logic Apps

  • Terraform / Bicep / Azure CLI / PowerShell / KQL

Microsoft Learn explains that Microsoft Sentinel uses Azure RBAC to provide built-in and custom roles.
Conditional Access is described by Microsoft as a Zero Trust policy engine that uses various signals to make policy decisions.
PIM is described as a Microsoft Entra ID service that manages, controls, and monitors access to important resources.

Items to decide during the design phase

1. Log collection targets

First, decide which logs to send to Sentinel.

High-priority candidates are as follows:

  • Microsoft Entra ID sign-in logs

  • Microsoft Entra ID audit logs

  • Azure Activity Log

  • Key Vault diagnostic logs

  • Storage diagnostic logs

  • Azure Firewall logs

  • Application Gateway / WAF logs

  • NSG flow logs

  • Defender for Cloud alerts

  • Microsoft 365 related logs

  • External logs such as EDR, VPN, SaaS, and Firewall

Sending all logs to Sentinel unconditionally increases costs and noise.
In practice, prioritize the following:

  • Changes to administrator privileges

  • Authentication failures and suspicious sign-ins

  • Changes to Conditional Access

  • Access to critical resources such as Key Vault and Storage

  • Traffic on externally exposed paths

  • Business systems handling personal or confidential information

  • Audit trails required by audits, contracts, and regulations

2. Log Analytics Workspace Design

For Workspace design, determine the following:

Design Item, Confirmation Points, Notes, Region, Log retention region, Check data location, contracts, and cross-border transfers, Segmentation policy, Production, testing, subsidiaries, overseas branches, Too much segmentation makes correlation analysis difficult, Access control, SOC, IT department, audit department, Separate least privilege from audit submission privileges, Retention period, Short-term analysis, medium-term audit, long-term audit trail, Align with contracts and regulations, Cost management, Ingestion volume, long-term retention, search frequency, Actual measurement of log volume is required, Automation, Terraform, Bicep, Policy, Detection of manual changes is also required

3. RBAC, ID Management, and Administrator Roles

For Sentinel operations, separate the following:

  • Sentinel Reader

  • Incident Responder

  • Analytics Rule Administrator

  • Data Connector Administrator

  • Workspace Administrator

  • Audit Trail Submission Personnel

  • SOC Outsourcing Representative

  • Emergency Administrator

Azure RBAC is a mechanism for managing access to Azure resources by assigning roles to users, groups, service principals, and managed identities.

In practice, you should avoid assigning the Contributor role to everyone.
Design roles separately for "viewing permissions," "investigation permissions," "configuration change permissions," and "audit trail submission permissions."

4. Conditional Access and PIM

Log auditing is linked not only to detection but also to preventive controls.

  • MFA required for administrators

  • Restrict administrator portals to trusted devices or specific conditions

  • Block legacy authentication as a general rule

  • Inventory emergency administrator accounts as exceptions

  • Reduce permanent administrators using PIM

  • Record the reason, approval, and duration when activating PIM

What is important here is to also make the settings for Conditional Access and PIM themselves subject to audit.
Ensure that you can track "who changed the policy" and "who activated administrator privileges" using Sentinel or Entra ID audit logs.

5. Network, Private Endpoint, NSG, and Azure Firewall

Network design is also important for log auditing.

A Private Endpoint is described as a network interface that connects you privately and securely to a service powered by Azure Private Link using a private IP address from your virtual network.
Microsoft Learn explains that when integrating Key Vault with Private Link, the Private Endpoint and the virtual network must be in the same region.

The items to check are as follows:

  • Should critical services be configured with Private Endpoints?

  • Should public network access be permitted?

  • Is access controlled to the minimum necessary using NSGs?

  • Are you collecting Azure Firewall logs?

  • Are you capturing audit logs for routing changes?

  • Have you designed the scope of responsibility for name resolution?

  • To what extent will the IT department handle troubleshooting in the event of a failure?

6. Key Vault and Encryption

Microsoft Learn explains that in Key Vault, you can manage permissions for keys, secrets, and certificates using Azure RBAC.

The items to verify are as follows:

  • RBAC design per Key Vault

  • Separation of keys, secrets, and certificates

  • Key Vault separation per application

  • Audit log collection

  • Key rotation policy

  • Purge protection and soft delete

  • Use of Private Endpoint

  • Auditing of administrator operations

  • Shared responsibility when using CMK

When migrating Microsoft Sentinel to the Defender portal, Microsoft Learn explains that the applicable policies for data storage, processing, retention, and sharing differ between using the Azure portal and the Defender portal. The handling of CMK after onboarding is also explained.
Therefore, existing encryption, data retention, and operational procedures must be reviewed before migration.

7. Azure Policy

Azure Policy is effective for reducing the number of resources without log configurations.
Microsoft Learn explains how to use built-in Azure Policies to send resource logs for supported resources to a Log Analytics Workspace, Event Hubs, or Storage Account.

In practice, you should decide the following:

  • Proper use of Audit, Deny, and DeployIfNotExists

  • Resource types for enforcing diagnostic settings

  • Exception request procedures

  • Differences between production and staging environments

  • Approval for policy changes

  • Compliance reports as audit trails

8. Defender for Cloud

Defender for Cloud is described as a CNAPP that provides visibility into the security posture of cloud and on-premises resources, supporting multi-cloud and hybrid environments.
Additionally, it is explained that recommendations allow you to check target resources, risk factors, attack paths, deadlines, status, and more.

When combining with Sentinel, do not just "view" Defender for Cloud recommendations; operationalize the following:

  • Personnel responsible for critical recommendations

  • Response deadlines

  • Exception approvals

  • Residual risks

  • Management reporting

  • Integration with Azure Policy

  • Correlation with Sentinel alerts

9. Backup and DR

The log infrastructure itself is a critical foundation for business continuity.

The Backup and recovery section of the Microsoft Cloud Security Benchmark describes controls for implementing, verifying, and protecting backups at each service layer.

The items to check are as follows.

  • Backup targets for critical systems

  • Recovery Services Vault design

  • Restore testing

  • Auditing backup logs

  • Response to Sentinel/Log Analytics outages

  • Recovery procedures for long-term retention logs

  • Evidence preservation and deletion prohibition

10. KQL, IaC, and Change Management

KQL is an area prone to becoming dependent on specific individuals.
For queries, maintain a ledger documenting the purpose, target tables, prerequisite logs, output format, and false-positive criteria.

This is a conceptual sample. Please verify its effectiveness in your specific environment.

SigninLogs
| where TimeGenerated > ago(7d)
| where ResultType != 0
| summarize FailureCount = count() by UserPrincipalName, IPAddress
| top 20 by FailureCount desc

This is an example of checking for administrator role changes.

AzureActivity
| where TimeGenerated > ago(30d)
| where OperationNameValue has "MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE"
| project TimeGenerated, Caller, ActivityStatusValue, ResourceGroup, _ResourceId
| order by TimeGenerated desc

If using Terraform or Bicep, manage the following:

  • Sentinel activation

  • Workspace configuration

  • Diagnostic settings

  • Azure Policy assignment

  • RBAC

  • Key Vault

  • Private Endpoint

  • Storage long-term retention

  • Change Approval History

  • Pull Request Review

  • State File Protection

6. Practical Points for Legal Aspects

The following are general confirmation perspectives; final legal judgments for individual contracts require confirmation by experts such as lawyers.

Clauses to Check in Cloud Contracts

For Sentinel implementation, SOC outsourcing, and Azure operation support contracts, check at least the following.

Clause Confirmation Perspectives: Items to be confirmed by the technical side: Service scope (monitoring, primary response, monthly reporting, scope of configuration changes), Scope of Sentinel, Defender, and Azure Monitor, Shared responsibility (responsibilities of Microsoft, your company, SOC, and subcontractors), Scope of separation during failures, SLA (uptime, support response, exclusion conditions, differences from internal SLOs), Failure notification (notification conditions, notification deadlines, notification recipients, detection paths, communication flow), Incident notification (unauthorized access, leakage, tampering, loss, connection between Sentinel incidents and internal judgments), Data location (log retention regions, support bases, Workspace regions, overseas SOC), Subcontracting (subcontractors, scope of work, country of location), Log viewing and operational authority (audit reports, questionnaires, feasibility of on-site audits), Evidence extraction and configuration confirmation (log provision format, deadlines, scope, authenticity, KQL, export, preservation), Data deletion and return (processing at contract termination and migration, Workspace, Storage, backup), Personal information (personal information/identifiers in logs, access control, retention period), Confidential information/trade secrets (file names, design information, operation history, viewing control, masking)

Microsoft Azure Legal Information organizes guidance on contracts related to Azure usage, Product Terms, DPA, Service Trust Portal, SLA, etc.
Regarding SLAs, Microsoft Learn explains that an SLA should not be read as a simple availability guarantee, but as a contract document including definitions, conditions, and exclusions.

Confirmation under the Act on the Protection of Personal Information

The Personal Information Protection Commission's guidelines organize safety management measures for personal data, employee supervision, subcontractor supervision, reporting of leaks, etc. In particular, subcontractor supervision indicates the selection of subcontractors, outsourcing contracts, grasping the status of personal data handling at the subcontractor, and confirmation during re-outsourcing.
Regarding safety management measures, it is explained that necessary and appropriate measures according to risks are required for the prevention of leakage, loss, or damage of personal data and other safety management.

In the Personal Information Protection Commission Q&A regarding the use of cloud services, it is explained that whether or not a cloud provider handles personal data becomes a criterion for judging third-party provision or outsourcing status. Examples are also given where it is stipulated in contract clauses that the cloud provider does not handle stored personal data and that access is appropriately controlled.

When overseas clouds or overseas support are involved, the PPC Q&A explains that regarding the handling of personal data in foreign countries, it is necessary to take safety management measures after understanding the personal information protection system of the foreign country, and that there are cases where it is necessary to make the server location country, etc., in a state where the individual can know it.

Clause Example: Log Provision

The following are general confirmation perspectives; final legal judgments for individual contracts require confirmation by experts such as lawyers.

The contractor shall maintain a system capable of providing the client with logs, audit trails, and incident-related information acquired or managed in connection with the operation of this service, to the extent necessary for the client to conduct security investigations, internal audits, explanations to business partners, or confirmation based on laws or internal regulations, in accordance with the retention period, format, submission method, and submission deadline specified in the appendix.

Clause Example: Incident Notification

The following are general confirmation perspectives; final legal judgments for individual contracts require confirmation by experts such as lawyers.

If the contractor becomes aware of unauthorized access, information leakage, tampering, loss, unavailability, or other significant information security events in connection with this service, the contractor shall notify the client within the deadline stipulated in the contract of the known facts, scope of impact, initial response, and the status of consideration of recurrence prevention measures.

Matters to be Reflected in Internal Regulations

  • Purpose of log usage

  • Log retention period

  • Log access permissions

  • Procedures for external log submission

  • Access scope for SOC contractors

  • Management of sub-contractors

  • Methods for verifying overseas access

  • Initial and follow-up reporting during incidents

  • Internal decision-making flow for personal information leaks

  • Data return and deletion upon contract termination

  • Preservation of audit trails

7. Incorporating into Security Standards

NIST CSF 2.0 is described as providing a high-level taxonomy of outcomes that organizations can use to understand, assess, prioritize, and communicate cybersecurity risks, rather than prescribing specific methods for achievement.
NIST SP 800-53 Rev.5 is described as a catalog of security and privacy controls for information systems and organizations, providing flexible and customizable controls to be implemented as part of an organization-wide risk management process.
Regarding ISO/IEC 27001:2022, the official ISO page describes it as a standard that specifies ISMS requirements.
Azure's ISO/IEC 27001-related information explains that Azure and other services undergo third-party audits and that Azure Policy's regulatory compliance built-in initiatives can be mapped to ISO/IEC 27001 domains and controls. However, it also notes that Azure Policy's compliance display is only a part of the overall compliance status.

Standard/Perspective | Practical Meaning | Azure-side Confirmation Example | Contract/Regulation-side Confirmation Example | Risks if Unconfirmed | NIST CSF 2.0 Govern | Manage risk as management | Monitoring targets, responsible persons, exception approvals | Risk acceptance, contractor management regulations | Unable to explain as it is left to the technical department | NIST CSF 2.0 Detect | Sentinel, Defender, KQL with detection capabilities | Monitoring procedures, monthly reports | Delayed incident discovery | NIST CSF 2.0 Respond | Logic Apps with response procedures, incident management | Notification clauses, response regulations | Delayed initial response, missed reports | NIST SP 800-53 AU | Audit log management | Log Analytics, Activity Log | Log retention/submission rules | Insufficient audit trails | NIST SP 800-53 AC | Access control | RBAC, PIM, Conditional Access | Authority management regulations | Excessive privileges, internal fraud | ISMS | Continuous improvement of risks and controls | Azure Policy, Defender recommendations | Declaration of applicability, internal audits | Unable to explain the effectiveness of controls | CIS Controls | High-priority implementation controls | Log management, vulnerability response, authentication operations | Checklists | Implementation gaps | MCSB | Control organization for Azure implementation | Logging, IR, Identity, Data Protection | Cloud usage regulations | Discrepancy between Azure settings and regulations | GDPR | EU personal data processing/transfer | Data location, access control | DPA, SCC, processor management | Insufficient confirmation of cross-border transfer/processing contracts | Personal Information Protection Act | Safety management/contractor supervision | Log access permissions, overseas access | Outsourcing contracts, explanation to individuals, ledgers | Insufficient explanation of safety management measures

Sources: NIST CSF 2.0, NIST SP 800-53 Rev.5, Microsoft Cloud Security Benchmark, ISO/IEC 27001, EUR-Lex GDPR, Personal Information Protection Commission Guidelines. The table above is organized based on official information from the perspectives of Azure operations, contract confirmation, and audit trails.

8. Charts and Tables

Table 1: Correspondence Table of Technical Requirements and Legal Confirmation Items

Decision Theme | Main User | Azure-side Confirmation Items | Legal/Regulation-side Confirmation Items | Risks if Unconfirmed | Next Action | Log Retention | IT/Audit | Workspace retention, Storage preservation | Retention period, submission format | No logs when needed | Create log retention policy table | Authority Management | IT | RBAC, PIM, CA | Authority management regulations | Excessive privileges/internal fraud | Administrator inventory | Diagnostic Settings | IT | Azure Policy, diagnostic settings | Audit target resource definition | Missing audit trails | Audit/Deploy via Policy | Incident Response | IT/Legal | Monitor, Alert, Runbook | SLA, notification deadlines | Unclear shared responsibility | Create RACI for incidents | Incident | CISO/Legal | Sentinel Incident, KQL | Leakage judgment, notification procedures | Delayed initial report | Initial response flow training | Sub-contracting | Legal | SOC authority, overseas access | Sub-contracting approval, audit rights | Insufficient contractor supervision | Update contractor ledger | Data Deletion | Legal/Audit | Workspace, Storage, Backup | Return/deletion/certification | Residual data after contract termination | Create deletion procedure manual

Sources: Microsoft Learn 'Azure Monitor Diagnostic Settings', 'Activity Log', 'Microsoft Sentinel', Microsoft Azure Legal Information, Personal Information Protection Commission Guidelines. Confirmation date: June 24, 2026.

Table 2: Role Distribution among IT Department, Legal Department, and Management

Phase: Information Systems, Legal Department, Management. Planning: Target systems, log types, estimated costs. Contracts/Personal Information/Subcontracting: Organizing issues, risk acceptance policy design. Sentinel, Workspace, RBAC, Policy: Contract clauses, regulations, subcontractor ledger. Investment Decision: Implementation, data connectors, diagnostic settings, KQL. Contract Appendix, Notification Flow: Priority monitoring targets, approval tests. Log Search, Alerts, Permission Confirmation: Audit trail submission, notification training. Business Impact Confirmation: Operational monitoring, tuning, monthly reports. Consistency Check with Contracts/Regulations: KPI confirmation, residual risk assessment. Audit Settings: Audit trails, log extraction, audit responses, subcontractor confirmation, board of directors/customer explanation.

Chart 3: Flow of Log Retention, Auditing, and Incident Response

[導入前]
対象業務・個人情報・機密情報を整理
        ↓
[設計]
ログ種別・保存期間・Workspace・RBAC・契約条項を決定
        ↓
[実装]
診断設定、データコネクタ、Azure Policy、KQL、アラートを構成
        ↓
[テスト]
ログ検索、証跡出力、権限分離、通知訓練、コスト確認
        ↓
[運用]
SOC監視、月次レビュー、Defender推奨事項、Policy準拠確認
        ↓
[インシデント]
検知、初動、証跡保全、通知、原因分析、再発防止
        ↓
[監査・改善]
契約・規程・技術設定・残存リスクを更新

Chart 4: Correspondence Table between Contract Clauses and Azure Settings

Contract Clause: Azure Setting/Audit Trail Explanation Material. Log Retention: Log Analytics retention, Storage retention, retention settings, extraction results. Log Provision: KQL, Export, Workbook, submission format, submission history. Incident Notification: Azure Monitor Alert, notification history, response records. Incident Notification: Sentinel Incident, initial report, follow-up report, closure reason. Subcontracting: SOC RBAC, PIM, permission ledger, access review. Data Location: Workspace region, region design document. Deletion/Return: Workspace deletion, Storage deletion, backup deletion procedure, certificate acquisition feasibility. Audit Rights: Policy compliance, Defender recommendations, monthly reports, exception ledger.

Chart 5: Correspondence Table between Azure Functions and Security Standards

Azure Function: Main Role, Corresponding Standard/Perspective. Microsoft Sentinel: SIEM, detection, investigation, response, NIST Detect/Respond, MCSB Logging/IR. Azure Monitor: Monitoring, metrics, logs, NIST AU, ISMS operational monitoring. Log Analytics: Log search, retention, NIST AU, CIS log management. Azure Policy: Control, audit, auto-remediation, ISMS, MCSB, internal control. Defender for Cloud: Security posture management, MCSB, CIS, NIST Identify/Protect. Entra ID: ID management, NIST AC, zero trust. Conditional Access: Access control, NIST AC, MCSB Identity. PIM: Privileged management, NIST AC, ISMS permission management. Key Vault: Secret/key management, NIST SC, Data Protection. Private Endpoint: Private connection, NIST SC, network control. Purview: Information governance, GDPR, personal information protection, ISMS.

9. Checklist for Information Systems Department

Confirmation Item: Azure Confirmation Location, Legal/Regulation Confirmation Destination, Risk if Unconfirmed, Priority. Are conditional access exception accounts inventoried?: Entra ID, Access Management Regulation, Compromise via exception, High. Is the administrator role the minimum privilege?: Azure RBAC / Entra ID, Permission Management Ledger, Excessive privilege, High. Have you considered the necessity of PIM usage?: Entra ID PIM, Privileged ID Regulation, Neglected permanent administrators, High. Have you decided how to handle emergency administrator accounts?: Entra ID, Exception Management Ledger, Lockout/unauthorized use, High. Are the log types to be sent to Sentinel decided?: Sentinel Data connectors, Log Management Regulation, Insufficient audit trail, High. Is the Workspace retention period decided?: Log Analytics, Retention Period Regulation, Audit deficiency, High. Have you designed long-term retention for Activity Logs?: Diagnostic settings, Audit requirements, Disappearance after 90 days, High. Does Azure Policy detect missing diagnostic settings?: Azure Policy, Control Regulation, Logs not acquired, High. Is the person in charge of Defender recommendations decided?: Defender for Cloud, Corrective Management, Improvement neglected, High. Are the responsibility boundaries for Private Endpoint, NSG, and Firewall clear?: Network, Responsibility Boundary Table, Confusion during failure, High. Is Key Vault access control clear?: Key Vault, Secret Information Management Regulation, Key/secret leakage, High. Have you performed backup and restore verification?: Azure Backup, BCP Regulation, Irrecoverable, High. Is the primary triage responsibility during failure clear in the contract?: Monitor / Support, SLA/Operational Contract, Response delay, High. Have you confirmed the feasibility of obtaining a data deletion certificate?: Workspace / Storage, Contract Termination Clause, Data remaining, High. Do change history and approval history for IaC remain?: Terraform / Bicep / Git, Change Management Regulation, Unauthorized changes, High.

10. Checklist for Legal Department

Confirmation Item (Contract/Regulation): Technical Matters to Confirm with InfoSys, Confirmation Material, Risk if Unconfirmed, Response Policy. Contract Entity: Azure contract form, sales channel, Contract, Product Terms, Unclear responsibility, Organize contract structure. Subcontractor: SOC, overseas support, Subcontractor list, Insufficient subcontractor supervision, Create ledger. Support Location: Presence of overseas access, Support specifications, Failure to confirm cross-border transfer, Confirm location. Data Location: Workspace region, Design document, Unknown data location, Specify region. Definition of Personal Information: Identifiers in logs, Personal Information Ledger, Regulation inconsistency, Redefine. Definition of Confidential Information: File names, operation history, Secret Information Management Regulation, Inadequate trade secret management, Review definition. Failure Notification Conditions: Monitor notification, SLA, Notification delay, Specify notification deadline. Leakage Notification Deadline: Sentinel detection flow, Incident Regulation, Reporting delay, Initial report procedure. Log Provision Scope: KQL extraction scope, Contract Appendix, Unable to submit, Specify format. Audit Rights: Policy compliance, setting audit trail, Audit clause, Insufficient effectiveness. Feasibility of Obtaining Reports: Audit report, ISO, SOC, etc., STP, etc., Lack of third-party evaluation, Confirm acquisition procedure. Data Return: Export feasibility, Contract Termination Clause, Difficult migration, Specify return format. Data Deletion: Deletion target, Backup deletion clause, Data remaining, Confirm deletion certificate. Relief for SLA Violation: Target service, SLA, Relief scope, Confirm conditions for exclusion. Limitation of Liability: Contract, Excessive risk, Lawyer confirmation. Subcontractor Management Ledger: Permission/log scope, Ledger, Audit deficiency, Regular updates.

11. Decision Points for Management

Management Decision Theme: Decision Content, InfoSys Issues, Legal Issues, Management Risk, Recommended Action. Log Audit Investment: How much to retain/analyze, Sentinel, Storage, Cost, Retention period, Audit trail submission, Inexplicable, Prioritize important systems. Risk Acceptance: What to accept, Technical constraints, Contractual limits, Over-investment/under-protection, Residual risk table. SOC Outsourcing: External monitoring scope, Permissions, Alerts, Subcontracting, Audit rights, Unclear responsibility, Create RACI. Zero Trust Phased Introduction: Entra, CA, PIM, Internal regulations, On-site confusion, Phased approach from target departments. Security Standards: Sales/audit utilization, MCSB, Defender, ISMS, NIST, Organization, Create disadvantage response table. Failure Priority: Recovery order, Backup, DR, SLA, Customer notification, Business suspension, Link with BCP. Personal Information Protection: Protection level, Log access control, Subcontractor supervision, Credibility loss upon leakage, Maintain ledger/regulations.

Management should not just ask, "Have you implemented Sentinel?" but should confirm the following:

  1. In the event of a major incident, when, who, and what audit trails can be produced?

  2. How much should be invested in log retention and audit response?

  3. Should residual risks that cannot be reduced through technology, contracts, regulations, or audits be accepted?

12. Support Areas of Yamazaki Administrative Scrivener Office

At Yamazaki Administrative Scrivener Office, we provide support that bridges the practical aspects of Azure design, implementation, and operational auditing with the legal documentation of contracts, regulations, personal information protection, and subcontractor management.

Cloud issues cannot be resolved by technology or contracts alone.
Visualizing IDs, logs, permissions, data locations, subcontracting, deletion certificates, and audit trails in a single table is the first step in practical work.

Our support areas are as follows.

  • Planning support for Azure adoption and migration

  • Azure design review

  • Organization of Azure implementation policies

  • Microsoft Entra ID design support

  • Conditional Access design support

  • Microsoft Defender for Cloud design and operational organization

  • Microsoft Sentinel log audit design support

  • Microsoft Purview information governance organization

  • Control design support using Azure Policy

  • Monitoring design support using Azure Monitor

  • Azure Virtual Desktop design support

  • Alignment organization with NIST CSF 2.0, NIST SP 800-53, ISMS, GDPR, etc.

  • Organization of review perspectives for cloud contracts, outsourcing agreements, and internal regulations

  • Documentation support for personal information protection, vendor management, and information management systems

  • Bridging the gap between IT and legal departments

  • Support for creating presentation materials for management

  • Support for organizing audit response materials

  • Support for developing cloud usage policies, generative AI usage policies, and information management regulations

However, matters involving legal disputes, negotiation representation, litigation response, or requiring individual legal judgment must be verified by professionals such as attorneys.

13. Conclusion

Microsoft Sentinel is more than just a log collection platform.
When designed properly, it becomes the core that connects authentication, authorization, networking, data protection, vendor management, personal information protection, and audit trails.

Here are three things you should start doing tomorrow.

  1. The IT department should create a list of log types to be sent to Sentinel, retention periods, RBAC, and diagnostic settings.

  2. The legal department should create a checklist for contracts regarding log provision, sub-outsourcing, incident notification, deletion/return, and cross-border data transfer.

  3. Management should decide the scope of investment for log auditing and the residual risks they are willing to accept.

In cloud auditing practice, simply having logs is not enough.
It is crucial that authorized personnel can submit them in the required format, at the required time, and in accordance with contracts and regulations.

At Yamazaki Administrative Scrivener Office, we organize this intersection of technology and law from both the perspectives of practical documentation and Azure design.

14. Confirmed Items

  1. Microsoft Sentinel is a cloud-native SIEM service that supports threat detection, investigation, response, and hunting.

  2. Sentinel ingests data via data connectors, and it is explained that it supports not only Microsoft services but also external data integration via Syslog, CEF, REST API, etc.

  3. Azure Activity Logs are deleted after 90 days of retention, and long-term retention requires separate storage via diagnostic settings.

  4. Azure Monitor diagnostic settings can be created via the portal, PowerShell, CLI, ARM, Bicep, REST API, etc.

  5. It is explained that Microsoft Sentinel uses Azure RBAC and other methods for authorization management.

  6. Conditional Access is explained as Microsoft's zero-trust policy engine.

  7. PIM is a Microsoft Entra ID service that manages, controls, and monitors access to critical resources.

  8. The Microsoft Cloud Security Benchmark is a cloud security guideline related to logs, threat detection, incident response, Azure Policy, etc.

  9. The Personal Information Protection Commission guidelines explain safety management measures, supervision of contractors, and verification during sub-outsourcing.

  10. The official text of the GDPR can be verified on EUR-Lex.

15. Summary Based on Official Information

  • Microsoft Sentinel is a SIEM platform that ingests logs from multiple data sources and uses them for threat detection, investigation, and response.

  • The standard retention period for Azure Activity Logs is 90 days; if long-term retention is required, you must design a separate storage solution using diagnostic settings or similar features.

  • By using Azure Policy, it is possible to design a system for deploying diagnostic settings and verifying compliance at scale.

  • The Microsoft Cloud Security Benchmark serves as a reference when organizing cloud security controls such as log collection, SIEM, incident response, and Azure Policy.

  • Under the Act on the Protection of Personal Information, it is important to confirm whether cloud providers handle personal data, and to verify aspects related to outsourcing, third-party provision, and cross-border transfers.

  • If GDPR is applicable, it is necessary to confirm roles such as controller and processor, processing agreements, technical and organizational measures, personal data breach notifications, and cross-border transfers.

16. Practical Considerations

  1. Implementing Sentinel is more likely to succeed in practice if it is designed in conjunction with contracts, internal regulations, and audit trails, rather than focusing solely on technical settings.

  2. Log retention periods should not be determined solely by the convenience of the IT department, but should be aligned with audits, contracts, personal information protection, explanations to business partners, and BCP.

  3. When outsourcing to a SOC, you should clarify not only the scope of responsibility for detection and initial response, but also log access permissions, sub-outsourcing, overseas locations, and the scope of evidence submission.

  4. Azure Policy and Defender for Cloud are effective when treated not just as technical recommendations, but as sources of information that can be used for internal controls, ISMS, and audit explanations.

  5. When explaining to management, the focus should be on residual risk, cost-effectiveness, audit explainability, and business continuity, rather than on product names.

17. Speculations and Hypotheses

This document does not make definitive claims regarding product specifications or legal effects that cannot be verified.
The following are general practical hypotheses.

  1. A lack of a log auditing infrastructure may put you at a disadvantage not only during an incident, but also during audits by business partners or during bidding processes.

  2. The effectiveness of a Sentinel implementation may be evaluated not by the volume of logs or the number of alerts, but by whether it can produce evidence that can be explained during a critical event.

  3. Creating a mapping table between NIST CSF 2.0 or ISMS and Azure settings may help facilitate consensus-building among IT, legal, and management teams.

18. Unverifiable Matters

The following cannot be determined without verifying individual environments and individual contracts.The following cannot be determined without verifying individual environments and individual contracts.

  1. The log retention period required for an individual company

  2. Whether GDPR applies to an individual company

  3. Validity of clauses in individual contracts, scope of damages, and limitation of liability

  4. Microsoft Sentinel features, licenses, and billing amounts available for individual tenants

  5. Whether KQL samples will work as-is in an individual environment

  6. Whether information contained in logs falls under personal information, personal data, or trade secrets

  7. Future feature changes, migration deadlines, and planned deprecations for Microsoft Sentinel that cannot be confirmed via official information

  8. Legal judgments in cases involving disputes

19. Main Reference Information

Confirmation Date: June 24, 2026

Microsoft-related

NIST Related

Act on the Protection of Personal Information Related

  • Source Name: Guidelines on the Act on the Protection of Personal Information (General Rules)
    Publisher: Personal Information Protection Commission
    URL: https://www.ppc.go.jp/personalinfo/legal/guidelines_tsusoku/
    Usage Location: Safety Management Measures, Supervision of Contractors, Data Breaches, etc.
    Usage Category: Summary

  • Source Name: Act on the Protection of Personal Information Q&A Q7-53
    Publisher: Personal Information Protection Commission
    URL: https://www.ppc.go.jp/all_faq_index/faq1-q7-53/
    Usage Location: Third-party provision and outsourcing classification when using cloud services
    Usage Category: Summary

  • Source Name: Act on the Protection of Personal Information Q&A Understanding the External Environment
    Publisher: Personal Information Protection Commission
    URL: https://www.ppc.go.jp/personalinfo/faq/APPI_QA/
    Usage Location: Foreign clouds, foreign systems, server location countries
    Usage Category: Summary

  • Source Name: Act on the Protection of Personal Information
    Publisher: e-Gov Law Search
    URL: https://laws.e-gov.go.jp/law/415AC0000000057/
    Usage Location: Entry point for confirming articles of the Personal Information Protection Act
    Usage Classification: Reference

GDPR/EU Related

ISMS/CIS Related

Microsoft Sentinel is not something you just 'install and forget'.

What is truly important is to simultaneously decide on log retention periods, shared responsibility models, sub-processing, audit rights, and failure/incident notification through Azure design, contracts, and internal regulations.

We have organized the practical discussion points that IT departments, legal teams, and management should review using the same table.

いいなと思ったら応援しよう！