Log forwarding from Cloud NGFW in Azure to Log Analytics Workspace for Sentinel

[A.Hwang]

Hi

I’m planning to replace Azure Firewall with Cloud NGFW in Azure, managed through SCM.

In addition to using Strata Logging Service (SLS), we also need to forward firewall logs to an Azure Log Analytics Workspace for Microsoft Sentinel (SIEM/SOAR).

Based on my research, there appear to be two possible approaches:

Option 1 - Cloud NGFW for Azure and Sentinel Integration

https://live.paloaltonetworks.com/t5/cloud-ngfw-for-azure-articles/cloud-ngfw-for-azure-and-sentinel...

This option looks ideal because Cloud NGFW logs would be sent directly to a Log Analytics Workspace inside the Azure environment, without additional configuration or external dependencies.

However, I would like to confirm if this integration also apply when Cloud NGFW is managed by SCM.(not using local rule stack).

Also wondering if the Cloud NGFW can forward specic logs (e.g. forward traffic/threat logs only, not URL/decryption logs).

Option 2 - Setup Forwarding to Microsoft Sentinel

https://docs.paloaltonetworks.com/prisma-access/integration/microsoft-integrations-with-prisma-acces...

This option is documented under Prisma Access, so I’m unsure if it also applies to Cloud NGFW managed by SCM.

I would prefer to avoid this approach because I assume traffic flow is inefficient:
Cloud NGFW → SLS (over the Internet) → Sentinel (over the Internet)

Given these considerations, which option would be best for an SCM-managed Cloud NGFW deployment?

Thanks