Monitoring Conditional Access events

As a security admin, an important part of your job will be to monitor and interpret any events that are recorded in relation to Conditional Access to ensure that it is doing its job correctly. In order to monitor and search for Conditional Access policy matches in Azure AD, you need to take the following steps:

1. From the Azure portal, select Azure Active Directory and choose Sign-in logs from the Monitoring section:

Figure 3.28: Monitoring Conditional Access

2. From the results displayed, filter by Conditional access:

Figure 3.29: Filtering by Conditional access

3. You can further filter the results by Success, Failure, or Not Applied:

Figure 3.30: Filtering results

Note

You can also monitor the device compliance status from the Microsoft Intune admin center by selecting Compliance status from the Devices | Overview...