You may notice in a multi-tenant AXA environment that the format of the tenant can change, also that there is a difference between the tenant value for login and the tenant value used in snippets for app monitoring or for log monitoring.
What format should I use for the tenant to configure Log Analytics?
While ingesting data into Jarvis for any Log Analytics/AXA tenant, the tenant ID (also called as cohort ID) value is used and is stored in @tenant_id field in Jarvis/Elasticsearch.
The tenant ID field can be of UUID (hex string) format or can be of the format <tenant-name>-USERSTORE depending on how the tenant is created.
Link to documentation about configuring UIM probes, which has more detail on checking the tenant ID value