Files.com keeps a record of everything that happens to your files: every login, upload, download, and permission change. This integration sends that record into Sentinel, each log type in its own table, so your security team can search and alert on file activity in KQL right alongside the rest of their Microsoft data.
No credit card required · 7-day free trial · Live in minutes
Real companies. Real file flows. Real results.
A Microsoft shop already pipes Entra ID sign-ins, Defender alerts, and Azure logs into Sentinel. The missing piece is file movement: who moved which regulated file, when, and how. Files.com fills it by sending every file event into Log Analytics.
Files.com sends its events into Log Analytics, the data behind Sentinel, so your security team can search and alert on file activity with the same KQL queries they already use for the rest of their Microsoft tools.
Files.com sorts events by type on the way in. SFTP sessions go to one table, settings changes to another. So when you go looking, everything is already in the right place.
The connection uses an Entra app registration and a rule you control in Azure. It is the same way the rest of your Azure data gets in, so there is nothing new for your team to learn.
The events come from the Files.com audit log, which can't be edited and is kept for 7+ years. Sentinel does the searching and alerting; Files.com holds the original, trustworthy record.
Turning the feed on is a setting, not a project. Paste in the app registration and rule values, pick the log types, and events start landing. There is no collector to host and no pipeline to babysit.
Sentinel reads the events. It doesn't decide who can touch which files or keep the record of what they did. Files.com does that part: access folder by folder, every action written to a record that can't be changed, and identity tied to Entra ID.
Hand each team, project, or person the exact folders they need. The person you see in a Sentinel query is the same account Entra ID controls through SSO, SAML, and SCIM.
Every login, upload, download, and permission change is written down with the who, the when, and the IP it came from. When an auditor asks how a file left, you answer from the record, not from memory.
People sign in to Files.com through Entra ID, and the Sentinel feed itself signs in with an Entra app registration you control. One identity system, end to end.
Files.com logs every delivery to Sentinel, so a dropped send is something you notice and fix, not something you discover mid-investigation. Event Channels can alert your team the moment a delivery fails.
Files.com sends each event into Log Analytics as it happens, ready for KQL searches and alerts in Sentinel. This is an Enterprise-plan feature, and it isn't on Starter or Power.
Files.com can also write log files to a folder on a schedule you set, from every 5 minutes up to every 6 hours, for batch ingest or a locked-down network. File delivery runs alongside the live stream, so one setup covers detection and the archive.
A questionable Entra sign-in is followed by a burst of downloads. With Files.com download events in Log Analytics, your team ties the sign-in to the downloads in one KQL query instead of jumping between tools.
Set up a rule on the Files.com SFTP table that opens an incident when one account suddenly pulls far more files than usual over SFTP.
After a breach, your team searches every Files.com event the account touched directly in Sentinel: uploads, downloads, links it opened, permissions it changed.
Setting changes flow into their own Files.com table in Sentinel; a rule alerts you when MFA or a permission setting changes when it shouldn't have.
The 7+ year record every Sentinel event traces back to. Search it in the app, pull it from the API, or have it delivered as files.
Learn More
Connect your Azure storage and send its file activity into the same Sentinel workspace, so the data and the record of who touched it land in one place.
Learn More
Connect sign-in to Entra ID with SSO and SCIM: provision someone and they get file access, deprovision them and it is removed right away.
Learn MoreEvery automation run is an event you can search in Sentinel, so a job that breaks shows up as an incident instead of failing quietly.
Learn MoreNovember 17–20, 2026 · San Francisco, CA
Files.com builds deeply on SharePoint, OneDrive, Azure, and Microsoft Entra ID, so of course we’ll be on the floor at Microsoft Ignite telling our File Orchestration story. The legacy MFT vendors won’t be there.
See Files.com At Microsoft Ignite
Software & Technology
Custom domains, automatic identity provisioning, and centrally enforced policies let Alight remove its MFT team from every client exchange without weakening control.
Read story →
Software & Technology
Aras rebuilt its folders, identities, and permissions before syncing the legacy estate, keeping daily exchanges as large as 1.5 TB running through the change.
Read story →
Health & Life Sciences
Sanitas standardized and monitored every partner feed through Files.com while keeping bulk storage and archives in Azure Blob.
Read story →
Banking & Finance
Files.com gave 26North’s single-digit technology team a repeatable way to absorb each counterparty’s SFTP, UAT, private-network, and retention requirements.
Read story →
“Files.com's strengths are simplicity, ease of use, and the cloud connectors. We don't have to invent custom infrastructure for every partner.”
“Files.com is versatile — it can manage many different situations from a single platform. We've consolidated multiple tools onto it.”
“Files.com is robust and scales to a large enterprise. We get multiple files per minute, per second — and we're a 24/7 organization, so everything has to always be up.”
How Files.com streams file events into your Sentinel workspace, which tables they land in, and what happens if a delivery fails.
Start your 7-day free trial: set up the connection, send a test event, and watch file activity land as a searchable table in Log Analytics.
No credit card required • 7-day free trial • Live in minutes