Chapter 14: Analyzing and Investigating Sign-in Logs and Elevated Risk Users

The previous chapter covered planning and implementing our privileged access for administrator accounts and managing them with access reviews. This included the benefits of using privileged identity management and how to audit these privileged assignments. In this chapter, we will discuss how to analyze, review, and investigate our logs and events for protecting against risky sign-ins and elevated risk users.

We're going to cover the following main topics:

• Analyzing and investigating sign-in logs to troubleshoot access issues
• Reviewing and monitoring Azure AD audit logs
• Analyzing Azure Active Directory workbooks and reporting

Technical requirements

In this chapter, we will continue to explore configuring a tenant for Microsoft 365 and Azure. There will be exercises that will require access to Azure Active Directory. If you have not yet created the trial licenses for Microsoft 365, please follow the directions provided within Chapter 1, Preparing for Your Microsoft Exam.

Analyzing and investigating sign-in logs to troubleshoot access issues

In Chapter 9, Planning, Implementing, and Administering Conditional Access and Azure Identity Protection, we discussed how user and sign-in risk can be used as a condition for access and authorization to applications. Azure Identity Protection utilizes the activity logs to determine potential threats, vulnerabilities, and anomalous behavior among users. Sign-in logs are based on two types of reporting: activity and security.

Activity reporting within Microsoft shows what is taking place within the infrastructure. The various activities include the following:

• Sign-ins, which is the usage information of managed applications and user sign-in activities within Azure AD or a hybrid identity architecture.
• Audit logs that provide system activity for users and groups, managed applications, and directory activities.
• Provisioning logs enable customers to monitor activity that pertains to the provisioning...

Reviewing and monitoring Azure AD audit logs

In the previous section, we discussed sign-in logs and the information that they provide in terms of user and application sign-in activity. This section will discuss Azure AD audit logs and the information that they provide for reviewing and monitoring compliance.

Azure AD reports provide information that you will need to monitor and determine what is taking place within your environment and how it is doing. Azure AD audit logs provide information and records that pertain to activities for compliance.

The following steps cover how to access the audit reports and review the information:

1. Within portal.azure.com, navigate to Azure Active Directory and select Audit logs under the Monitoring section of the menu:

Figure 14.13 – Audit logs

2. View the default view that lists the following information: the data and time of the occurrence, the service that logged the occurrence, the category and...

Analyzing Azure Active Directory workbooks and reporting

The previous section explained how to access the different audit reports within Azure AD to review and monitor compliance. Activity logs and audit logs provide reports for our usage and compliance within Azure AD for users, groups, and applications. In addition to these reports, usage and insights reports can provide additional application-centric views into sign-in data.

The information within usage and insights can provide information such as the following:

• The most used applications within the company
• Applications that have the most failed sign-ins
• The top sign-in errors for each of your applications

The licensing within your tenant to access usage and data reports required is either an Azure AD Premium P1 or P2 license. Users are required to have the role of Security Administrator, Security Reader, Report Reader, or Global Administrator. As stated throughout this book, you should adhere to the principles...

Summary

In this chapter, we covered how to analyze and investigate sign-in logs and elevated risk users within Azure AD. This included sign-in logs and audit logs, and how to configure and filter reports for these logs. We looked at how to review usage and insights workbooks for activity. We also reviewed how to monitor, troubleshoot, and configure alert notifications for Azure AD Domain Services managed domains.

In the next chapter we will learn how to enable and integrate Azure AD Logs with SIEM Solutions.