Chapter 4. Monitoring Your Identity Bridge

Monitoring your identity synchronization processes, your Active Directory health status, and the functionality of your ADFS and Web Application Proxy authentication platform is essential for your organization. Also, gathering performance data is necessary to provide a suitable infrastructure. 

In this practical chapter, we'll explore the various monitoring capabilities for the identity bridge that's constructed by Azure AD Connect, the Active Directory itself and, if used, the ADFS and the Web Application Proxy. We'll investigate the Azure AD Monitoring and logs functionalities, the Azure AD Connect Health service, and the Azure Security Center to get a good idea of several use cases to provide an efficient and accurate monitoring to deliver a stable and suitable identity infrastructure for connecting to Azure AD.

This chapter will cover the following topics:

• How Azure AD Connect Health works
• Azure AD Monitoring and logs
• Azure Security Center for monitoring...

How Azure AD Connect Health works

Azure AD Connect Health offers you the ability to monitor and gain insights into the identity infrastructure used to extend on-premises identities to Azure Active Directory and Office 365. You can view alerts, performance information, usage patterns, and configuration settings; it enables you to maintain a reliable connection to Office 365 and much more. This is accomplished by using an agent that's installed on the targeted servers.

The diagram that follows shows how Azure AD Connect Health communicates. It also shows the components that are currently supported:

• Active Directory Domain Services (ADDS) 2008R2 up to 2016
• Azure AD Connect Version 1.0.9125 or higher
• Active Directory Federation Services (ADFS) and Windows Azure Pack (WAP) 2008R2 up to 2016

Note

You can find the actual support and licensing requirements at https://docs.microsoft.com/en-us/azure/active-directory/hybrid/reference-connect-health-faq.

The following diagram shows the architecture of the...

Azure AD monitoring and logs

In the Azure portal, under the Azure AD blade and the Monitoring section, we also get insights into the Azure platform and the associated on-premises identity infrastructure.

We can view the complete Sign-ins to the several services, as well as Audit logs, additional logs, and diagnostic information. The following screenshot shows the actual Sign-ins to our environment, including the time, user, application, and status. Furthermore, you will see whether the access was protected by a conditional access rule or Azure MFA itself:

By clicking on an entry, you get many more details:

Note

To provide programmatic access to your Azure Active Directory data over the REST-based APIs, you can use this guide: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/tutorial-access-api-with-certificates.

You're also able to extend your reporting capabilities with Power BI by clicking the Power BI icon. If you do so, the following screen appears:

1. Click My organization...

Azure Security Center for monitoring and analytics

In this section, we'll explore the Azure Security Center's capabilities for monitoring our identity and access-management infrastructure. With the Azure Security Center, you're able to understand the security state across your on-premises environments and cloud workloads. New Azure resources will be automatically discovered and on-boarded and you can apply security policies across your complete hybrid environment to ensure compliance with actual security standards. The service also provides the collection, search, and analysis of several sources, including third-party solutions and firewalls. Furthermore, we can find threats with advanced analysis mechanisms and are able to respond and recover from incidents because of the provided real-time security alerts. The export of your security events into an SIEM solution for further analysis is possible. The service integrates many new threat-detection parts, such as behavioral profiling, machine...

Summary

In this chapter, we discussed the key monitoring and log capabilities to hold your identity infrastructure in a stable and suitable state. We learned which functionality is provided by the Azure AD section in the Azure portal. Furthermore, we saw how Azure AD Connect Health works and how easy it is to install and configure your environment. We extended our solution and now have a broader view of the whole security state of the hybrid environment through the Azure Security Center. You should be able to answer questions about the identity infrastructure-monitoring capabilities and to configure a suitable monitoring and log solution for your own organization or customers. 

In the next chapter, we will learn how to use the Azure Identity Protection features to protect your cloud and on-premises environment. We will discuss and configure the Azure AD Privileged Identity Management capabilities.