Enable diagnostics of AAD to Log Analytics

ARM template sample

{
    "$schema": "https://schema.management.azure.com/schemas/2019-08-01/tenantDeploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "logAnalyticsResourceId": {
            "type": "string",
            "metadata": {
                "description": "Provide the resourceId to your Log Analytics workspace that will receive the AAD auding/sign-in logs."
            }
        }
    },
    "resources": [
        {
            "type": "microsoft.aadiam/diagnosticSettings",
            "apiVersion": "2017-04-01",
            "name": "setByARM",
            "properties": {
                "workspaceId": "[parameters('logAnalyticsResourceId')]",
                "logAnalyticsDestinationType": null,
                "logs": [
                    {
                        "category": "AuditLogs",
                        "enabled": true,
                        "retentionPolicy": {
                            "days": 0,
                            "enabled": false
                        }
                    },
                    {
                        "category": "SignInLogs",
                        "enabled": true,
                        "retentionPolicy": {
                            "days": 0,
                            "enabled": false
                        }
                    }
                ],
                "metrics": []
            }
        }
    ],
    "outputs": {}
}

If you want to be able to turn on all of the other categories for Diagnostic Logging (more than signin/audit logs)
You can hit the below repository json file

https://raw.githubusercontent.com/debaxtermsft/debaxtermsft/main/diaglogs2.json