0

I setup an Office365/Azure tenancy for a small charity I help. I am keen to setup automated reporting that sends an email when someone logs in as an admin account (i.e with a particular role or group).

The main things I am trying to achieve are

  1. Visibility of when a 3rd party support organisation logging in to change the tenancy
  2. Visibility of when an internal staff member logs in, including staff who have moved on and we believe their accounts are disabled
  3. Visibility of unknown accounts logging in (i.e. a newly created admin account by a nefarious actor)

All I have been able to find is how to alert on a specific user, which can help with the first 2 requirements (although it means setting up an alert per account), however it doesn't cover the 3rd requirement.

Is it possible to setup an alert in Azure to send an email to a nominated address when any account with the Global Admin role logs in ?

Dels
  • 1
  • maybe my script can help in one point https://github.com/djdomi/Powershell-Scripts/blob/main/powershell_announce_failed_logins.ps1 – djdomi Apr 05 '22 at 05:44
  • Thanks @djdomi, I think your script runs on domain controller to harvest that information from event logs. * Note that I probably left out the key point that I'm not looking for logins to machines, just to logins to the Office365 / Azure platforms. As such, I'm looking for the platform to create an alert from a platform log. i.e. Microsoft numerous services covering SEIM, Monitoring, Security services etc, so I'm very much hoping my use case of easily reporting on admin logins, should be available out of the box, but I can't find it.Hence my question to the community for Azure expertise. – Dels Apr 05 '22 at 08:05

1 Answers1

0

Azure AD Sign-In logs contain the information you need to detect when someone signs in. You can export these logs to a Log Analytics workspace and then setup an alert for when someone signs in with a Global Admin role.

This article has some step-by-step details on how it can be done.

Sam Cogan
  • 38,158
  • 6
  • 77
  • 113
  • Thanks for your response. That link shows how to monitor for a specific account. i.e. "I want to know when user X or Y logs in." What I'm looking for is "I want to know when a user, who I do not know the username, but has role ABC logs in". * I am trying to safeguard against unknown accounts being created and given admin roles by a bad actor. * Alternatively I can setup a powershell scipt to download accounts and memberships and email, but this seems very old school and I'd hoped Azure could help. Any ideas on being able to do this from Azure would be most appreciated :) – Dels May 04 '22 at 22:45