{"id":55758,"date":"2024-01-17T09:45:00","date_gmt":"2024-01-17T09:45:00","guid":{"rendered":"https:\/\/infrasos.com\/?p=55758"},"modified":"2024-01-16T16:47:01","modified_gmt":"2024-01-16T16:47:01","slug":"detecting-security-incidents-with-microsoft-entra-id-auditing","status":"publish","type":"post","link":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/","title":{"rendered":"Detecting Security Incidents with Microsoft Entra ID Auditing"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"55758\" class=\"elementor elementor-55758\">\n\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-61b5c7d e-con-boxed e-con\" data-id=\"61b5c7d\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-89a8188 elementor-widget elementor-widget-text-editor\" data-id=\"89a8188\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#69727d;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#69727d;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID environment is essential for maintaining <a href=\"https:\/\/infrasos.com\/azure-security-monitoring-and-alerting-of-security-events\/\">robust security measures<\/a>. One of the fundamental tools in this quest is the <a href=\"https:\/\/infrasos.com\/azure-ad-auditing-enabling-and-configuring-audit-logs\/\">Audit log<\/a>, a repository of historical records capturing<a href=\"https:\/\/infrasos.com\/office-365-reporting\/\"> user activities<\/a> within the organization. This article shows aspects of Microsoft Entra ID Audit logs, its role in <a href=\"https:\/\/infrasos.com\/azure-threat-detection-and-response-how-to-detect-and-respond\/\">threat detection<\/a>, and the incident responding best practices.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-84cb749 e-con-boxed e-con\" data-id=\"84cb749\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-d3a2dbf elementor-widget elementor-widget-text-editor\" data-id=\"d3a2dbf\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Well, let&#8217;s continue this article title Detecting Security Incidents with Microsoft Entra ID Auditing to find more below.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ae4f8be elementor-widget elementor-widget-text-editor\" data-id=\"ae4f8be\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/leveraging-azure-ad-audit-data-for-compliance-and-reporting\/\">Leveraging Azure AD Audit Data for Compliance and Reporting<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e2813d9 elementor-widget elementor-widget-heading\" data-id=\"e2813d9\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h2 class=\"elementor-heading-title elementor-size-default\">What is Microsoft Entra ID Audit Log?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-45beb51 e-con-boxed e-con\" data-id=\"45beb51\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-728875e elementor-widget elementor-widget-text-editor\" data-id=\"728875e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>User behaviour in Microsoft Entra ID is monitored using Activity logs. They include three log types &#8211; <a href=\"https:\/\/infrasos.com\/check-azure-ad-audit-logs-for-user-sign-ins-success-and-failures\/\">Sign-in Logs<\/a>, Provisioning Logs and Audit Logs. Audit logs accurately record the history of all tasks executed within your tenant, offering a detailed account of actions taken. Included in all editions of Microsoft Entra ID (even the free one) and designed to capture modifications to applications, <a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-group-reports\/\">groups<\/a>, users, and licenses.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-56eccd3 e-con-boxed e-con\" data-id=\"56eccd3\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-0584472 elementor-widget elementor-widget-image\" data-id=\"0584472\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.12.2 - 23-04-2023 *\/\n.elementor-widget-image{text-align:center}.elementor-widget-image a{display:inline-block}.elementor-widget-image a img[src$=\".svg\"]{width:48px}.elementor-widget-image img{vertical-align:middle;display:inline-block}<\/style>\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA00.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Detecting Security Incidents with Microsoft Entra ID Auditing\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTU3NjAsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEyXC9BQURBMDAucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/AADA00-qh13nf2zlkwsxuwhm9ltxzs1xjfdci65xdkso2weyq.png\" title=\"Detecting Security Incidents with Microsoft Entra ID Auditing\" alt=\"Detecting Security Incidents with Microsoft Entra ID Auditing\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-5ee095f e-con-boxed e-con\" data-id=\"5ee095f\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c36c9af elementor-widget elementor-widget-text-editor\" data-id=\"c36c9af\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Audit log (as well as other activity logs) are accessed in various ways. Simplest way is to open <a href=\"https:\/\/entra.microsoft.com\/\" target=\"_blank\" rel=\"noopener\">Microsoft Entra admin center<\/a> using account that has the necessary permissions and navigate to <strong>Monitoring &amp; health<\/strong> &gt; <strong>Audit logs<\/strong>.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-029a2c3 e-con-boxed e-con\" data-id=\"029a2c3\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-216a1dc elementor-widget elementor-widget-heading\" data-id=\"216a1dc\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Roles that can access the Audit Logs<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4e39e0e e-con-boxed e-con\" data-id=\"4e39e0e\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1f06d91 elementor-widget elementor-widget-text-editor\" data-id=\"1f06d91\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li>Reports Reader<\/li><li>Security Reader<\/li><li>Security Administrator<\/li><li>Global Reader<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b5b93fa e-con-boxed e-con\" data-id=\"b5b93fa\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-5cc2b8d elementor-widget elementor-widget-image\" data-id=\"5cc2b8d\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Microsoft Entra ID Audit Logs\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTU3NjIsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEyXC9BQURBMDEucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"768\" height=\"416\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01-768x416.png\" class=\"attachment-medium_large size-medium_large wp-image-55762\" alt=\"Microsoft Entra ID Audit Logs\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01-768x416.png 768w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01-300x162.png 300w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01-1024x554.png 1024w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01-720x390.png 720w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA01.png 1155w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6ac8b4d e-con-boxed e-con\" data-id=\"6ac8b4d\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c4d6f2c elementor-widget elementor-widget-text-editor\" data-id=\"c4d6f2c\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Here you see the list of log entries, which can be exported or filtered to return the needed information. By default, in this view you see the below information.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5d324d3 elementor-widget elementor-widget-heading\" data-id=\"5d324d3\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Default (list) view of logs includes:<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-754eb52 e-con-boxed e-con\" data-id=\"754eb52\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-915e995 elementor-widget elementor-widget-text-editor\" data-id=\"915e995\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li>Date \/ time of the event.<\/li><li>Service that logged the event.<\/li><li>What was done.<\/li><li>Was the change successful.<\/li><li>Which object was modified.<\/li><li>Who initiated the change.<\/li><\/ul><p>Select any entry to view the detailed information. The <strong>Audit Log Details<\/strong> window contains three tabs \u2013 <strong>Activity<\/strong>, <strong>Target(s)<\/strong> and <strong>Modified Properties<\/strong>, each provides the relevant information.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-7ff3030 e-con-boxed e-con\" data-id=\"7ff3030\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-9c6989d elementor-widget elementor-widget-image\" data-id=\"9c6989d\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA02.png\" data-elementor-open-lightbox=\"yes\" data-elementor-lightbox-title=\"Microsoft Entra ID Audit Logs details\" data-e-action-hash=\"#elementor-action%3Aaction%3Dlightbox%26settings%3DeyJpZCI6NTU3NjMsInVybCI6Imh0dHBzOlwvXC9pbmZyYXNvcy5jb21cL3dwLWNvbnRlbnRcL3VwbG9hZHNcLzIwMjNcLzEyXC9BQURBMDIucG5nIn0%3D\">\n\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"562\" height=\"686\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA02.png\" class=\"attachment-medium_large size-medium_large wp-image-55763\" alt=\"Microsoft Entra ID Audit Logs details\" srcset=\"https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA02.png 562w, https:\/\/infrasos.com\/wp-content\/uploads\/2023\/12\/AADA02-246x300.png 246w\" sizes=\"(max-width: 562px) 100vw, 562px\" \/>\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c34550a e-con-boxed e-con\" data-id=\"c34550a\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1da09cc elementor-widget elementor-widget-text-editor\" data-id=\"1da09cc\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Additionally, you can see the logs using Get-AzureADAuditDirectoryLogs cmdlet (part of AzureADPreview PowerShell module) or using Microsoft Graph API (details are found in <a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/monitoring-health\/howto-access-activity-logs#access-logs-with-microsoft-graph-api\" target=\"_blank\" rel=\"noopener\">Access logs with Microsoft Graph API<\/a>. \u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c619292 e-con-boxed e-con\" data-id=\"c619292\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-c895ea0 elementor-widget elementor-widget-template\" data-id=\"c895ea0\" data-element_type=\"widget\" data-widget_type=\"template.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-template\">\n\t\t\t\t\t<div data-elementor-type=\"section\" data-elementor-id=\"7917\" class=\"elementor elementor-7917\">\n\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-inner-section elementor-element elementor-element-30c8dcce ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default elementor-invisible\" data-id=\"30c8dcce\" data-element_type=\"section\" data-settings=\"{&quot;animation&quot;:&quot;bounceInRight&quot;,&quot;background_background&quot;:&quot;gradient&quot;}\">\n\t\t\t\t\t\t\t<div class=\"elementor-background-overlay\"><\/div>\n\t\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-19a106e2 ot-flex-column-vertical\" data-id=\"19a106e2\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-ca1a12e elementor-widget elementor-widget-heading\" data-id=\"ca1a12e\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Try our Active Directory & Office 365 Reporting & Auditing Tools<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4c539a35 elementor-widget elementor-widget-text-editor\" data-id=\"4c539a35\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #ff6600;\">Try us out<\/span> for <span style=\"color: #ff0000;\">Free<\/span>.\u00a0 100&#8217;s of report templates available. Easily customise your own reports on AD, Azure AD &amp; Office 355.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-inner-column elementor-element elementor-element-16296eed ot-flex-column-vertical\" data-id=\"16296eed\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-65568df5 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"65568df5\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor-pro - v3.10.3 - 29-01-2023 *\/\n.elementor-button.elementor-hidden,.elementor-hidden{display:none}.e-form__step{width:100%}.e-form__step:not(.elementor-hidden){display:flex;flex-wrap:wrap}.e-form__buttons{flex-wrap:wrap}.e-form__buttons,.e-form__buttons__wrapper{display:flex}.e-form__indicators{display:flex;justify-content:space-between;align-items:center;flex-wrap:nowrap;font-size:13px;margin-bottom:var(--e-form-steps-indicators-spacing)}.e-form__indicators__indicator{display:flex;flex-direction:column;align-items:center;justify-content:center;flex-basis:0;padding:0 var(--e-form-steps-divider-gap)}.e-form__indicators__indicator__progress{width:100%;position:relative;background-color:var(--e-form-steps-indicator-progress-background-color);border-radius:var(--e-form-steps-indicator-progress-border-radius);overflow:hidden}.e-form__indicators__indicator__progress__meter{width:var(--e-form-steps-indicator-progress-meter-width,0);height:var(--e-form-steps-indicator-progress-height);line-height:var(--e-form-steps-indicator-progress-height);padding-right:15px;border-radius:var(--e-form-steps-indicator-progress-border-radius);background-color:var(--e-form-steps-indicator-progress-color);color:var(--e-form-steps-indicator-progress-meter-color);text-align:right;transition:width .1s linear}.e-form__indicators__indicator:first-child{padding-left:0}.e-form__indicators__indicator:last-child{padding-right:0}.e-form__indicators__indicator--state-inactive{color:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-inactive [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-inactive-secondary-color,#fff)}.e-form__indicators__indicator--state-inactive object,.e-form__indicators__indicator--state-inactive svg{fill:var(--e-form-steps-indicator-inactive-primary-color,#c2cbd2)}.e-form__indicators__indicator--state-active{color:var(--e-form-steps-indicator-active-primary-color,#39b54a);border-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-active-secondary-color,#fff)}.e-form__indicators__indicator--state-active object,.e-form__indicators__indicator--state-active svg{fill:var(--e-form-steps-indicator-active-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed{color:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator--state-completed [class*=indicator--shape-]:not(.e-form__indicators__indicator--shape-none){background-color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator__label{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a)}.e-form__indicators__indicator--state-completed .e-form__indicators__indicator--shape-none{color:var(--e-form-steps-indicator-completed-primary-color,#39b54a);background-color:initial}.e-form__indicators__indicator--state-completed object,.e-form__indicators__indicator--state-completed svg{fill:var(--e-form-steps-indicator-completed-secondary-color,#fff)}.e-form__indicators__indicator__icon{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);font-size:var(--e-form-steps-indicator-icon-size);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;overflow:hidden;margin-bottom:10px}.e-form__indicators__indicator__icon img,.e-form__indicators__indicator__icon object,.e-form__indicators__indicator__icon svg{width:var(--e-form-steps-indicator-icon-size);height:auto}.e-form__indicators__indicator__icon .e-font-icon-svg{height:1em}.e-form__indicators__indicator__number{width:var(--e-form-steps-indicator-padding,30px);height:var(--e-form-steps-indicator-padding,30px);border-width:1px;border-style:solid;display:flex;justify-content:center;align-items:center;margin-bottom:10px}.e-form__indicators__indicator--shape-circle{border-radius:50%}.e-form__indicators__indicator--shape-square{border-radius:0}.e-form__indicators__indicator--shape-rounded{border-radius:5px}.e-form__indicators__indicator--shape-none{border:0}.e-form__indicators__indicator__label{text-align:center}.e-form__indicators__indicator__separator{width:100%;height:var(--e-form-steps-divider-width);background-color:#c2cbd2}.e-form__indicators--type-icon,.e-form__indicators--type-icon_text,.e-form__indicators--type-number,.e-form__indicators--type-number_text{align-items:flex-start}.e-form__indicators--type-icon .e-form__indicators__indicator__separator,.e-form__indicators--type-icon_text .e-form__indicators__indicator__separator,.e-form__indicators--type-number .e-form__indicators__indicator__separator,.e-form__indicators--type-number_text .e-form__indicators__indicator__separator{margin-top:calc(var(--e-form-steps-indicator-padding, 30px) \/ 2 - var(--e-form-steps-divider-width, 1px) \/ 2)}.elementor-field-type-hidden{display:none}.elementor-field-type-html{display:inline-block}.elementor-login .elementor-lost-password,.elementor-login .elementor-remember-me{font-size:.85em}.elementor-field-type-recaptcha_v3 .elementor-field-label{display:none}.elementor-field-type-recaptcha_v3 .grecaptcha-badge{z-index:1}.elementor-button .elementor-form-spinner{order:3}.elementor-form .elementor-button>span{display:flex;justify-content:center;align-items:center}.elementor-form .elementor-button .elementor-button-text{white-space:normal;flex-grow:0}.elementor-form .elementor-button svg{height:auto}.elementor-form .elementor-button .e-font-icon-svg{height:1em}.elementor-select-wrapper .select-caret-down-wrapper{position:absolute;top:50%;transform:translateY(-50%);inset-inline-end:10px;pointer-events:none;font-size:11px}.elementor-select-wrapper .select-caret-down-wrapper svg{display:unset;width:1em;aspect-ratio:unset;fill:currentColor}.elementor-select-wrapper .select-caret-down-wrapper i{font-size:19px;line-height:2}.elementor-select-wrapper.remove-before:before{content:\"\"!important}<\/style>\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"7917\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"65568df5\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9e7317e elementor-widget elementor-widget-text-editor\" data-id=\"9e7317e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/office-365-reporting\/\">Get more insight into user behaviour with Office 365 Reporting Tool<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ea0da6f elementor-widget elementor-widget-heading\" data-id=\"ea0da6f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What Threats Can Be Detected in Microsoft Entra ID Audit?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-b29e45d e-con-boxed e-con\" data-id=\"b29e45d\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6691cc6 elementor-widget elementor-widget-text-editor\" data-id=\"6691cc6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Audit Logs play an important role in detecting and mitigating various security threats in your Microsoft Entra ID environment. Here are some examples of threats that can be detected using Audit Logs.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8c353fc elementor-widget elementor-widget-heading\" data-id=\"8c353fc\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Account Compromise<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f93d224 elementor-widget elementor-widget-text-editor\" data-id=\"f93d224\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>The most important threat that is identified using Audit logs. Changes to user accounts, password resets, or modifications to group memberships that were not initiated by the account owner may suggest a compromised account.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8bada93 elementor-widget elementor-widget-heading\" data-id=\"8bada93\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Role Escalation<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-50fa765 elementor-widget elementor-widget-text-editor\" data-id=\"50fa765\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Unauthorized changes to <a href=\"https:\/\/infrasos.com\/azure-ad-roles-and-permissions-assign-manage-roles-for-users-groups\/\">user roles and permissions<\/a>, especially administrative roles, are detected. For example, if a regular user gains elevated privileges without proper authorization. This kind of events may mean malicious action. Accident modifying of users\u2019 permission or ignoring of the change management process (which is a non-compliance with the security standards).<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-12596fd elementor-widget elementor-widget-heading\" data-id=\"12596fd\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Group Membership Changes<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bec55e7 elementor-widget elementor-widget-text-editor\" data-id=\"bec55e7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Changes to group memberships can be monitored to detect unauthorized modifications or additions. Usually, <a href=\"https:\/\/infrasos.com\/get-azureadgroup-filter-examples-for-powershell-group-reporting\/\">groups in Microsoft Entra ID are used to regulate access to certain data<\/a> (e.g. in OneDrive for Business), therefore, this event is considered as an attempt to get unauthorized access to the data.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cea2d23 elementor-widget elementor-widget-heading\" data-id=\"cea2d23\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Configuration Changes<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8f6cd64 elementor-widget elementor-widget-text-editor\" data-id=\"8f6cd64\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Monitoring changes to Microsoft Entra ID <a href=\"https:\/\/infrasos.com\/azure-security-center-best-practices-how-to-secure-azure\/\">configurations, policies, or security settings<\/a> helps to identify potential security risks introduced by configuration modifications.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-85b6375 elementor-widget elementor-widget-heading\" data-id=\"85b6375\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Malicious Application Activities<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-420e591 elementor-widget elementor-widget-text-editor\" data-id=\"420e591\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Unusual behavior or configuration changes related to applications may indicate <a href=\"https:\/\/infrasos.com\/why-monitoring-azure-ad-user-activity-is-essential-for-security\/\">malicious activities<\/a>. Changing to the applications registered in Microsoft Entra ID and the permissions provided to the service principals used by applications are also monitored to prevent unauthorized access by applications.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c4ada84 elementor-widget elementor-widget-heading\" data-id=\"c4ada84\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">User Deletion or Suspension<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f7a193e elementor-widget elementor-widget-text-editor\" data-id=\"f7a193e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Unexpected deletions or suspensions of user accounts, particularly those with elevated privileges, could be a sign of malicious activity.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9605875 elementor-widget elementor-widget-heading\" data-id=\"9605875\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">License Assignment<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8f0bff0 elementor-widget elementor-widget-text-editor\" data-id=\"8f0bff0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Detection of instances where licenses are assigned to users without proper authorization or outside the established processes may identify the <a href=\"https:\/\/infrasos.com\/leveraging-azure-ad-audit-data-for-compliance-and-reporting\/\">policy violations and ignoring of license assignment<\/a> procedures.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b649b9d elementor-widget elementor-widget-text-editor\" data-id=\"b649b9d\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-rbac-audit-monitor-and-analyze-azure-ad\/\">Azure AD RBAC Audit: Monitor and Analyze Azure AD<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c79c5d elementor-widget elementor-widget-heading\" data-id=\"9c79c5d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to Detect Threats Using the Auditing?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c45f399 e-con-boxed e-con\" data-id=\"c45f399\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-799b1ac elementor-widget elementor-widget-text-editor\" data-id=\"799b1ac\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>To utilize the<a href=\"https:\/\/infrasos.com\/how-to-configure-azure-ad-activity-logs-for-effective-monitoring\/\"> log records effectively<\/a>, integration with monitoring tool is required. Microsoft Entra ID Audit logs can be integrated with both third-party monitoring tools and tools built into Azure (such as<a href=\"https:\/\/infrasos.com\/azure-security-monitoring-and-alerting-of-security-events\/\"> Azure Monitoring and Microsoft Sentinel<\/a>).<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-243dcf0 elementor-widget elementor-widget-heading\" data-id=\"243dcf0\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Benefit of integration with Monitoring Tools<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-c2564b1 e-con-boxed e-con\" data-id=\"c2564b1\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-581d194 elementor-widget elementor-widget-text-editor\" data-id=\"581d194\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><strong>Enhanced Security Monitoring:<\/strong> By integrating audit logs with monitoring tools, you gain real-time visibility into user and system activities. This allows for<a href=\"https:\/\/infrasos.com\/office-365-threat-intelligence-detecting-and-responding\/\"> proactive identification of suspicious behaviour or security incidents<\/a>, enabling timely response and mitigation.<\/li><li><strong>Centralized Management:<\/strong> Integration consolidates Microsoft Entra ID audit logs with other monitoring data, creating a centralized view of your environment. This simplifies management, analysis, and correlation of information, leading to better insights into user activities across various systems.<\/li><li><strong>Anomaly Detection and Alerting:<\/strong> By leveraging monitoring tools, you <a href=\"https:\/\/infrasos.com\/azure-security-monitoring-and-alerting-of-security-events\/\">set up alerts<\/a> based on specific audit log events or unusual patterns, allowing prompt detection of anomalies or potential security threats. If you decide to use Azure Monitor for this purpose, select from various notification methods, such as email, SMS and push notifications.<\/li><li><strong>Enhanced Incident Response:<\/strong> Integrated monitoring tools enable faster incident response by offering detailed insights into the sequence of events. This aids in post-incident investigations and forensics, facilitating better understanding and resolution of security issues.<\/li><\/ul><p>Additionally, monitoring tools combined with Microsoft Entra ID audit logs help in meeting <a href=\"https:\/\/infrasos.com\/leveraging-azure-ad-audit-data-for-compliance-and-reporting\/\">compliance requirements<\/a> by providing detailed records of user actions. It aids in fulfilling audit requests and ensuring adherence to regulatory standards.<\/p><p>By default, audit logs are stored for 7 days for Microsoft Entra ID Free subscription, and for 30 days for other subscriptions (more details <a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/monitoring-health\/reference-reports-data-retention\" target=\"_blank\" rel=\"noopener\">here<\/a>).But, utilizing of external tools for the logs\u2019 retention (usually this functionality is built-in to monitoring tools) is required.<\/p><p>To parse logs during the investigation, you may require to use querying capabilities of the tool you used to aggregate the logs. For example, if you used Azure Monitor or Azure Sentinel for this purpose, utilize the Kusto Query Language (KQL). Therefore, teaching the responsible personnel how to use KQL should be the part of the tool implementation.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a1ff44b elementor-widget elementor-widget-text-editor\" data-id=\"a1ff44b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/best-practices-for-responding-to-azure-ad-security-incidents\/\">Best Practices for Responding to Azure AD Security Incidents<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5df6f9d elementor-widget elementor-widget-heading\" data-id=\"5df6f9d\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">How to Respond to the Incidents?<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-4f4d526 e-con-boxed e-con\" data-id=\"4f4d526\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4436462 elementor-widget elementor-widget-text-editor\" data-id=\"4436462\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Now with Detecting Security Incidents with Microsoft Entra ID Auditing when there is a detection of an incident using Microsoft Entra ID Audit log, please follow the incident response plan. It usually consists of several steps. Example of the incident plan is provided below.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b2f624a elementor-widget elementor-widget-heading\" data-id=\"b2f624a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">1. Investigation and Prioritization<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e94eb9b elementor-widget elementor-widget-text-editor\" data-id=\"e94eb9b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ol><li style=\"list-style-type: none;\"><ul><li><strong>Review Logs:<\/strong> Analyze the Microsoft Entra ID Audit Logs to understand the scope and nature of the incident. Look for patterns, anomalies, and details related to the suspicious activities, perform the timeline analysis.<\/li><li><strong>Correlate Data:<\/strong> Correlate information from Microsoft Entra ID Audit Logs with logs from other sources, if available. Such as Microsoft Entra ID logs (such as Sign-in logs), logs from the affected applications, or information from security information and event management system. Additionally, Microsoft Entra integrates with the user provisioning automation systems, which need to be checked as well. The more information is collected, the easier it is to identify the root cause.<\/li><li><strong>Prioritize the incident:<\/strong> Offer background information to the <a href=\"https:\/\/infrasos.com\/red-team-vs-blue-team-in-cybersecurity-whats-the-difference\/\">responsible team<\/a>, aiding them in prioritizing incidents by considering alert severity. For example, if during investigation some privileged account was compromised \u2013 it should be considered as a high-priority incident, while incidents with policy incompliance (like assignment of a license without the proper authorization) could have lower priority.<\/li><\/ul><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d18c2d5 elementor-widget elementor-widget-heading\" data-id=\"d18c2d5\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">2.\tContainment and Eradication<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d793ee3 elementor-widget elementor-widget-text-editor\" data-id=\"d793ee3\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ol><li style=\"list-style-type: none;\"><ul><li><strong>Disable Affected Accounts:<\/strong> Microsoft Entra ID Audit primarily deals with identity-related activities, such as user sign-ins,<a href=\"https:\/\/infrasos.com\/how-to-automate-azure-ad-rbac-role-management-with-powershell\/\"> role assignments<\/a>, and license changes. Responses need to focus on securing and managing identities effectively. Therefore, if user account compromise is suspected, consider disabling of the account temporarily to prevent further unauthorized access.<\/li><li><strong>Adjust Permissions:<\/strong> Review and adjust permissions, especially if there&#8217;s evidence of unauthorized role escalation or changes in group memberships.<\/li><li><strong>Remove Malicious Artifacts:<\/strong> Identify and remove any malicious artifacts introduced during the incident, such as unauthorized accounts, configurations, or applications.<\/li><li><strong>Notify Stakeholders:<\/strong> Keep relevant stakeholders informed about the incident, especially if it involves sensitive data or has the potential to impact operations.<\/li><\/ul><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8020544 elementor-widget elementor-widget-heading\" data-id=\"8020544\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">3. Recovery<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7c3fdf0 elementor-widget elementor-widget-text-editor\" data-id=\"7c3fdf0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ol><li style=\"list-style-type: none;\"><ul><li><strong>Restore Services:<\/strong> If services or resources were affected, work on restoring them to normal operation.<\/li><li><strong>Review and Enhance Security Controls:<\/strong> Evaluate the security controls that failed to prevent the incident and consider enhancing them. This may involve adjusting policies, configurations, or implementing additional security measures. For example, if user credentials were compromised, password policies and the <a href=\"https:\/\/infrasos.com\/setup-azure-conditional-access-multi-factor-authentication-mfa\/\">usage multi-factor authentication<\/a> must be enhanced. Additionally, leveraging built-in security features of Microsoft Entra ID, such as <a href=\"https:\/\/infrasos.com\/azure-ad-conditional-access-implement-access-policies-controls\/\">Conditional Access policies<\/a>, Identity Protection, and Security Defaults, may be part of the response strategy.<\/li><li><strong>Update Credentials:<\/strong> Change the affected credentials (such as <a href=\"https:\/\/infrasos.com\/office-365-reporting\/office-365-password-reports\/\">user passwords<\/a> or service principal secrets), if any. \u00a0<\/li><li><strong>Legal and Compliance Considerations:<\/strong> Adhere to legal and regulatory requirements regarding incident reporting and notification.<\/li><\/ul><\/li><\/ol>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dcf316f elementor-widget elementor-widget-heading\" data-id=\"dcf316f\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">4. Post-Incident Actions<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-30c36b9 elementor-widget elementor-widget-text-editor\" data-id=\"30c36b9\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ol><li style=\"list-style-type: none;\"><ul><li><strong>Root Cause Analysis:<\/strong> Conduct a thorough analysis of the incident to determine the root cause and identify lessons learned.<\/li><li><strong>Documentation:<\/strong> Document the incident response process, actions taken, and recommendations for reducing probability of repeating of the incident and improving future incident response. Update the existing Incident Response Plan if needed.<\/li><li><strong>Training and Awareness:<\/strong> Provide additional training for staff to enhance awareness of security best practices and potential threats.<\/li><\/ul><\/li><\/ol><p>It is important to remember that incident response is an ongoing process, and continuous improvement is essential to adapting to evolving threats. Regularly review and update your incident response plan based on emerging risks and experiences gained from incident handling. Additionally, collaborating with relevant stakeholders and external cybersecurity experts provides valuable insights and assistance during incident response efforts.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-31c8d9f elementor-widget elementor-widget-text-editor\" data-id=\"31c8d9f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Hope, our article Detecting Security Incidents with Microsoft Entra ID Auditing added to your knowledge. Let&#8217;s conclude.\u00a0<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1181541 elementor-widget elementor-widget-text-editor\" data-id=\"1181541\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"color: #ff6600;\"><strong>Also Read\u00a0<a href=\"https:\/\/infrasos.com\/azure-ad-auditing-enabling-and-configuring-audit-logs\/\">Azure AD Auditing: Enabling and Configuring Audit Logs<\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-319ddc3 elementor-widget elementor-widget-heading\" data-id=\"319ddc3\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-large\">Responding to Security Incidents with Microsoft Entra ID Auditing Conclusion<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-e21ab04 e-con-boxed e-con\" data-id=\"e21ab04\" data-element_type=\"container\" data-settings=\"{&quot;content_width&quot;:&quot;boxed&quot;}\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-94a4e9e elementor-widget elementor-widget-text-editor\" data-id=\"94a4e9e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Audit Logs, as a part of Microsoft Entra ID activity logs, act as the eyes and ears, meticulously documenting user actions and system changes, enabling the detection of potential vulnerabilities and threats. However, their true power comes to light when integrated with robust <a href=\"https:\/\/infrasos.com\/top-10-best-siem-tools-for-cyber-attack-monitoring\/\">monitoring tools<\/a>, elevating security measures by offering real-time insights, anomaly detection, and centralized management. Embracing a proactive approach to threat detection and incident response, while continually refining incident handling protocols, is imperative for fortifying your defences against the cyber threats.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-314d7ecf elementor-section-content-middle ot-traditional elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"314d7ecf\" data-element_type=\"section\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-extended\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-5531584c ot-flex-column-vertical\" data-id=\"5531584c\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-3a8388b3 elementor-widget elementor-widget-image\" data-id=\"3a8388b3\" data-element_type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img loading=\"lazy\" decoding=\"async\" width=\"113\" height=\"101\" src=\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/05\/InfraSOS-Logo-Icon-1.png\" class=\"attachment-full size-full wp-image-5788\" alt=\"InfraSOS-AD-Tools\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-691152df ot-flex-column-vertical\" data-id=\"691152df\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-2bcdee81 elementor-widget elementor-widget-heading\" data-id=\"2bcdee81\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Try InfraSOS for FREE<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-42d0f0a8 elementor-widget elementor-widget-text-editor\" data-id=\"42d0f0a8\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Try InfraSOS Active Directory, Azure AD &amp; Office 365 Reporting &amp; Auditing Tool<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3e55e4b6 elementor-button-align-center elementor-invisible elementor-widget elementor-widget-global elementor-global-5815 elementor-widget-form\" data-id=\"3e55e4b6\" data-element_type=\"widget\" data-settings=\"{&quot;button_width&quot;:&quot;50&quot;,&quot;step_next_label&quot;:&quot;Next&quot;,&quot;step_previous_label&quot;:&quot;Previous&quot;,&quot;_animation&quot;:&quot;pulse&quot;,&quot;step_type&quot;:&quot;none&quot;,&quot;step_icon_shape&quot;:&quot;circle&quot;}\" data-widget_type=\"form.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<form class=\"elementor-form\" method=\"post\" name=\"InfraSOS Email Capture\">\n\t\t\t<input type=\"hidden\" name=\"post_id\" value=\"55758\"\/>\n\t\t\t<input type=\"hidden\" name=\"form_id\" value=\"3e55e4b6\"\/>\n\t\t\t<input type=\"hidden\" name=\"referer_title\" value=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n\n\t\t\t\n\t\t\t<div class=\"elementor-form-fields-wrapper elementor-labels-above\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-type-email elementor-field-group elementor-column elementor-field-group-email elementor-col-50 elementor-field-required\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<input size=\"1\" type=\"email\" name=\"form_fields[email]\" id=\"form-field-email\" class=\"elementor-field elementor-size-lg  elementor-field-textual\" placeholder=\"Enter your email address\" required=\"required\" aria-required=\"true\">\n\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<div class=\"elementor-field-group elementor-column elementor-field-type-submit elementor-col-50 e-form__buttons\">\n\t\t\t\t\t<button type=\"submit\" class=\"elementor-button elementor-size-lg\">\n\t\t\t\t\t\t<span >\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\" elementor-button-icon\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Try InfraSOS FREE<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/button>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t<\/form>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2e2ae74 elementor-icon-list--layout-inline elementor-list-item-link-full_width elementor-widget elementor-widget-icon-list\" data-id=\"2e2ae74\" data-element_type=\"widget\" data-widget_type=\"icon-list.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<link rel=\"stylesheet\" href=\"https:\/\/infrasos.com\/wp-content\/plugins\/elementor\/assets\/css\/widget-icon-list.min.css\">\t\t<ul class=\"elementor-icon-list-items elementor-inline-items\">\n\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-icon\">\n\t\t\t\t\t\t\t<i aria-hidden=\"true\" class=\"fas fa-arrow-up\"><\/i>\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">Free 15-Days Trial<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t<li class=\"elementor-icon-list-item elementor-inline-item\">\n\t\t\t\t\t\t\t\t\t\t<span class=\"elementor-icon-list-text\">SaaS AD Reporting & Auditing Solution<\/span>\n\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t<\/ul>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID environment is essential for maintaining robust security measures. One of the fundamental tools in this quest is the Audit log, a repository of historical records capturing user activities within the organization. This article shows aspects [&hellip;]<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[35],"tags":[67,45,134,113],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Detecting Security Incidents with Microsoft Entra ID Auditing<\/title>\n<meta name=\"description\" content=\"Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Detecting Security Incidents with Microsoft Entra ID Auditing\" \/>\n<meta property=\"og:description\" content=\"Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID\" \/>\n<meta property=\"og:url\" content=\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\" \/>\n<meta property=\"og:site_name\" content=\"Active Directory Tools, Report, Monitor &amp; Manage AD\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/infrasos\/\" \/>\n<meta property=\"article:published_time\" content=\"2024-01-17T09:45:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-16T16:47:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/AADA00-qh13nf2zlkwsxuwhm9ltxzs1xjfdci65xdkso2weyq.png\" \/>\n<meta name=\"author\" content=\"Marat M\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:site\" content=\"@infra_sos\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Marat M\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\"},\"author\":{\"name\":\"Marat M\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/91383d9702fb0e1cf1ad74c02a1a1e86\"},\"headline\":\"Detecting Security Incidents with Microsoft Entra ID Auditing\",\"datePublished\":\"2024-01-17T09:45:00+00:00\",\"dateModified\":\"2024-01-16T16:47:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\"},\"wordCount\":1750,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"keywords\":[\"azure ad\",\"cybersecurity\",\"Microsoft Entra\",\"monitoring\"],\"articleSection\":[\"Azure AD\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\",\"url\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\",\"name\":\"Detecting Security Incidents with Microsoft Entra ID Auditing\",\"isPartOf\":{\"@id\":\"https:\/\/infrasos.com\/#website\"},\"datePublished\":\"2024-01-17T09:45:00+00:00\",\"dateModified\":\"2024-01-16T16:47:01+00:00\",\"description\":\"Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID\",\"breadcrumb\":{\"@id\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/infrasos.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Detecting Security Incidents with Microsoft Entra ID Auditing\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/infrasos.com\/#website\",\"url\":\"https:\/\/infrasos.com\/\",\"name\":\"Active Directory Tools, Report, Monitor &amp; Manage AD\",\"description\":\"Active Directory &amp; Office 365 SaaS Reporting Tool\",\"publisher\":{\"@id\":\"https:\/\/infrasos.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/infrasos.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/infrasos.com\/#organization\",\"name\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\",\"url\":\"https:\/\/infrasos.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"contentUrl\":\"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png\",\"width\":113,\"height\":101,\"caption\":\"InfraSOS - Active Directory & Office 365 Reporting Tools\"},\"image\":{\"@id\":\"https:\/\/infrasos.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/infrasos\/\",\"https:\/\/twitter.com\/infra_sos\",\"https:\/\/www.linkedin.com\/showcase\/86283876\",\"https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/91383d9702fb0e1cf1ad74c02a1a1e86\",\"name\":\"Marat M\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/infrasos.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4cae23af7c9550258e5289df67d06080?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4cae23af7c9550258e5289df67d06080?s=96&d=mm&r=g\",\"caption\":\"Marat M\"},\"description\":\"System administrator with 14 years of practical experience. Specializes in Microsoft products such as Exchange Server, Active Directory, Microsoft 365 and Azure.\",\"url\":\"https:\/\/infrasos.com\/author\/marat-4fgmail-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Detecting Security Incidents with Microsoft Entra ID Auditing","description":"Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/","og_locale":"en_US","og_type":"article","og_title":"Detecting Security Incidents with Microsoft Entra ID Auditing","og_description":"Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID","og_url":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/","og_site_name":"Active Directory Tools, Report, Monitor &amp; Manage AD","article_publisher":"https:\/\/www.facebook.com\/infrasos\/","article_published_time":"2024-01-17T09:45:00+00:00","article_modified_time":"2024-01-16T16:47:01+00:00","og_image":[{"url":"https:\/\/infrasos.com\/wp-content\/uploads\/elementor\/thumbs\/AADA00-qh13nf2zlkwsxuwhm9ltxzs1xjfdci65xdkso2weyq.png"}],"author":"Marat M","twitter_card":"summary_large_image","twitter_creator":"@infra_sos","twitter_site":"@infra_sos","twitter_misc":{"Written by":"Marat M","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#article","isPartOf":{"@id":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/"},"author":{"name":"Marat M","@id":"https:\/\/infrasos.com\/#\/schema\/person\/91383d9702fb0e1cf1ad74c02a1a1e86"},"headline":"Detecting Security Incidents with Microsoft Entra ID Auditing","datePublished":"2024-01-17T09:45:00+00:00","dateModified":"2024-01-16T16:47:01+00:00","mainEntityOfPage":{"@id":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/"},"wordCount":1750,"commentCount":0,"publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"keywords":["azure ad","cybersecurity","Microsoft Entra","monitoring"],"articleSection":["Azure AD"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/","url":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/","name":"Detecting Security Incidents with Microsoft Entra ID Auditing","isPartOf":{"@id":"https:\/\/infrasos.com\/#website"},"datePublished":"2024-01-17T09:45:00+00:00","dateModified":"2024-01-16T16:47:01+00:00","description":"Detecting Security Incidents with Microsoft Entra ID Auditing. Understanding the core functions and potential threats related to Microsoft Entra ID","breadcrumb":{"@id":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/infrasos.com\/detecting-security-incidents-with-microsoft-entra-id-auditing\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/infrasos.com\/"},{"@type":"ListItem","position":2,"name":"Detecting Security Incidents with Microsoft Entra ID Auditing"}]},{"@type":"WebSite","@id":"https:\/\/infrasos.com\/#website","url":"https:\/\/infrasos.com\/","name":"Active Directory Tools, Report, Monitor &amp; Manage AD","description":"Active Directory &amp; Office 365 SaaS Reporting Tool","publisher":{"@id":"https:\/\/infrasos.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/infrasos.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/infrasos.com\/#organization","name":"InfraSOS - Active Directory & Office 365 Reporting Tools","url":"https:\/\/infrasos.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/","url":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","contentUrl":"https:\/\/infrasos.com\/wp-content\/uploads\/2022\/10\/InfraSOS-Logo-Icon.png","width":113,"height":101,"caption":"InfraSOS - Active Directory & Office 365 Reporting Tools"},"image":{"@id":"https:\/\/infrasos.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/infrasos\/","https:\/\/twitter.com\/infra_sos","https:\/\/www.linkedin.com\/showcase\/86283876","https:\/\/www.youtube.com\/channel\/UCfGszuZdgxZYBg8DGIWxXCg"]},{"@type":"Person","@id":"https:\/\/infrasos.com\/#\/schema\/person\/91383d9702fb0e1cf1ad74c02a1a1e86","name":"Marat M","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/infrasos.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4cae23af7c9550258e5289df67d06080?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4cae23af7c9550258e5289df67d06080?s=96&d=mm&r=g","caption":"Marat M"},"description":"System administrator with 14 years of practical experience. Specializes in Microsoft products such as Exchange Server, Active Directory, Microsoft 365 and Azure.","url":"https:\/\/infrasos.com\/author\/marat-4fgmail-com\/"}]}},"_links":{"self":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/55758"}],"collection":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/comments?post=55758"}],"version-history":[{"count":30,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/55758\/revisions"}],"predecessor-version":[{"id":56280,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/posts\/55758\/revisions\/56280"}],"wp:attachment":[{"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/media?parent=55758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/categories?post=55758"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infrasos.com\/wp-json\/wp\/v2\/tags?post=55758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}