Stream the audit events to Microsoft Sentinel

Send every audit event to a Log Analytics workspace through a data collection rule.

In short

Connect Microsoft Sentinel once. Every audit event is sent to your Log Analytics workspace through a data collection rule, signed and retried.

Who: someone who may manage the organization's connections - owners and admins have it by default.
Plan: the audit stream comes with the Enterprise plan, and the 14-day trial has it.
First, in the Azure portal: a "Data collection endpoint", a custom table in the workspace and a "Data collection rule" with a stream for it.
And an "App registration" with a client secret, given the "Monitoring Metrics Publisher" role on the rule ("Access control (IAM)").

Open your organization, then Settings › "Connections", and press "Stream the audit events".
Choose "Microsoft Sentinel". The wizard opens; each step is checked before the next one opens.
Read what you need and press "Next".
Open the data collection endpoint's "Overview" and copy "Logs Ingestion". Paste it into "Logs ingestion address".
From the app registration's "Overview" copy "Directory (tenant) ID" and "Application (client) ID" into the fields with the same names.
Open the data collection rule, press "JSON View" and copy "immutableId" (it starts with dcr-) into "Data collection rule immutable ID".
Type the rule's stream into "Stream name", such as Custom-AuditEvents_CL, and press "Check this step", then "Next".

Press "Open the token page". In the app registration open "Certificates & secrets" › "New client secret".
Copy its "Value" - not the Secret ID - into "Client secret" and press "Check this step". A test event reaches the table within a few minutes.
Press "Next".

Press "Run the full check". It sends one more test event; every step should say Passed.
Check the "Name" and press "Finish". The audit stream shows under "Audit stream" with its health.
From then on every audit event is sent as it happens. "Deliveries" on the row lists what was sent and what the destination answered.

"Test event" failed: the destination did not take the event. Check the address and the token or key, and that the app has "Monitoring Metrics Publisher" on the rule and the stream name matches the rule.
"Where it lives" failed: the address is not https, or it is a private address your installation does not reach.
Change what the step says and press "Check again". Closing the wizard keeps every step that passed; "Continue setup" on the row goes on.

Only audit events are sent - who did what and when, with the record's kind and id - never your records' content.
Every page of events is signed and retried until the destination takes it. A destination that stays down turns the row's health to Down and says so.
One audit stream per organization. To move it, disconnect it and connect the new one.
Plan: the audit stream comes with the Enterprise plan, and the 14-day trial has it.