Monitor Azure AD by using Log Analytics, including KQL queries

Monitoring Azure Active Directory (Azure AD) is essential for maintaining the security and availability of your organization’s identity and access management infrastructure. By using Azure Monitor Log Analytics, administrators can track activities, detect potential security incidents, and ensure that Azure AD is functioning as expected. This involves the collection of logs, analyzing them using KQL (Kusto Query Language), and then interpreting the results to make informed decisions.

Collecting Azure AD Logs

To monitor Azure AD with Log Analytics, you must first ensure that activity logs are being collected. Azure AD provides several types of logs that can be ingested into Azure Monitor Log Analytics:

• Sign-in logs – Information about sign-ins and how your resources are accessed.
• Audit logs – Data that shows the history of changes applied to resources within Azure AD.
• Provisioning logs – Record of synchronization activities between Azure AD and other services.
• Risk detection and risky user logs – Security logs containing potential threat activities.

You can forward these logs to Azure Monitor by enabling the diagnostic settings in Azure AD. This allows you to send the logs to a Log Analytics workspace, where they will be stored and made available for analysis.

Analyzing Logs with KQL

Once data is collected in Log Analytics, you can use Kusto Query Language (KQL) to filter, sort, and analyze that data. KQL is a powerful language that allows for complex analytics and aggregations based on your specific needs.

Example Queries

Here are some example KQL queries that you might use to track activities in Azure AD:

– Query to retrieve sign-in logs:

SigninLogs
| where TimeGenerated > ago(1d)

This retrieves sign-in logs from the last day, helping you monitor recent activity.

– Query to examine risky sign-ins:

SigninLogs
| where RiskLevel during (high, medium)
| project TimeGenerated, UserPrincipalName, Location, RiskDetail, RiskLevel

This will list sign-ins that were flagged as high or medium risk, focusing on the most critical events.

– Query to filter logins by a specific user:

SigninLogs
| where UserPrincipalName == “[email protected]”

Using this query can help you track the sign-in patterns for a specific user account.

– Query to count the sign-in activities per application:

SigninLogs
| summarize Count = count() by AppDisplayName
| order by Count desc

This query will summarize the number of sign-in activities by application, providing insights into which apps are most used.

Interpreting Query Results

The results of your KQL queries provide a wealth of data that can be insightful and actionable. For example:

• An unexpected spike in sign-in failures might indicate a brute force attack.
• Sign-ins from unusual locations could suggest compromised credentials.
• High-risk login attempts might warrant immediate attention and potential remediation.

Alerting based on Log Analysis

Setting up alerts based on specific events or thresholds detected in your log data can further enhance monitoring. Azure Monitor provides the capability to create alert rules from the results of KQL queries. For instance:

• You can create an alert to notify your security team if there is an abnormal number of failed login attempts within a short time frame.
• Alerts can also be set for when new users are granted administrator roles, enabling you to quickly review and validate these changes.

Comparison of Monitoring Approaches

Conclusion

Monitoring Azure AD with Azure Monitor Log Analytics provides a robust set of tools to secure and manage an organization’s identities. With the power of KQL, administrators can create precise queries to sift through vast amounts of log data, interpret patterns, set up alerts, and respond to potential security threats effectively. Understanding and using these capabilities are essential for anyone tasked with the responsibility of Azure AD management and security, such as those preparing for the SC-300 Microsoft Identity and Access Administrator exam.