You have a Microsoft Entra tenant that has a Microsoft Entta ID P2 license.

According to the Microsoft SC-300 Study Guide and Microsoft Learn module: “Monitor and troubleshoot Microsoft Entra ID” , in order to view Microsoft Entra ID audit log information in Azure Monitor (and thereby in a Log Analytics workspace), you must first configure diagnostic settings for Microsoft Entra ID.

By default, Entra ID audit logs are retained within the Microsoft Entra portal for 30 days (for P1) or 180 days (for P2). To integrate these logs into Azure Monitor for advanced analysis, alerting, and retention, administrators must explicitly enable and direct log export through Diagnostic settings.

Steps include:

In the Microsoft Entra admin center, navigate to Monitoring → Diagnostic settings.

Select Audit Logs (and optionally, Sign-in Logs).

Choose Send to Log Analytics workspace and select the desired workspace.

This configuration allows continuous streaming of Entra ID audit data into Azure Monitor, where it can be queried with Kusto Query Language (KQL).

Other options such as creating a workbook or running PowerShell cmdlets ( update-MgOrganization or update-ngoomain ) do not initiate log forwarding.