↳ GitHub sourceConnector

Microsoft Entra ID

Description

Gain insights into Microsoft Entra ID by connecting Audit and Sign-in logs to Microsoft Sentinel to gather insights around Microsoft Entra ID scenarios. You can learn about app usage, conditional access policies, legacy auth relate details using our Sign-in logs. You can get information on your Self Service Password Reset (SSPR) usage, Microsoft Entra ID Management activities like user, group, role, app management using our Audit logs table. For more information, see the [Microsoft Sentinel documentation](https://go.microsoft.com/fwlink/?linkid=2219715&wt.mc_id=sentinel_dataconnectordocs_content_cnl_csasci).

Declared status: 1
Declared author / publisher: Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

read and write permissions.

Workspace

Workspace

Diagnostic Settings

read and write permissions to AAD diagnostic settings.

/providers/microsoft.aadiam

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Connect Microsoft Entra ID logs to Microsoft Sentinel

Select Microsoft Entra ID log types:

Sign-In Logs

Audit Logs

Non-Interactive User Sign-In Log

Service Principal Sign-In Logs

Managed Identity Sign-In Logs

Provisioning Logs

ADFS Sign-In Logs

User Risk Events

Risky Users

Network Access Traffic Logs

Risky Service Principals

Service Principal Risk Events

Related content

Links established from declared identifiers and solution manifests.

Analytics rules175

Account Created and Deleted in Short TimeframeHigh Account created from non-approved sourcesMedium Account created or deleted by non-approved userMedium Account Elevated to New RoleMedium Addition of a Temporary Access Pass to a Privileged AccountHigh Admin promotion after Role Management Application Permission GrantHigh Anomalous login followed by Teams actionMedium Anomalous sign-in location by user account and authenticating applicationMedium Anomalous Single Factor SigninLow Anomaly Sign In Event from an IPMedium Application ID URI ChangedMedium Application Redirect URL UpdateMedium Attempt to bypass conditional access rule in Microsoft Entra IDLow Attempts to sign in to disabled accountsMedium Authentication Attempt from New CountryMedium Authentication Method Changed for Privileged AccountHigh Authentication Methods Changed for Privileged AccountHigh Authentications of Privileged Accounts Outside of Expected ControlsMedium Azure Portal sign in from another Azure TenantMedium Azure RBAC (Elevate Access)High Brute force attack against an Entra-authenticated Windows deviceMedium Brute force attack against Azure PortalMedium Brute Force Attack against GitHub AccountMedium Bulk Changes to Privileged Account PermissionsHigh Changes to Application Logout URLLow Changes to Application OwnershipMedium Changes to PIM SettingsHigh Cisco - firewall block but success logon to Microsoft Entra IDMedium Conditional Access - A Conditional Access app exclusion has changedLow Conditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)Low Conditional Access - A Conditional Access policy was deletedLow Conditional Access - A Conditional Access policy was disabledLow Conditional Access - A Conditional Access policy was put into report-only modeLow Conditional Access - A Conditional Access policy was updatedInformational Conditional Access - A Conditional Access user/group/role exclusion has changedHigh Conditional Access - A new Conditional Access policy was createdInformational Conditional Access - Dynamic Group Exclusion ChangesHigh Conditional Access Policy Modified by New UserMedium Credential added after admin consented to ApplicationMedium Cross-Cloud Password Spray detectionMedium Cross-Cloud Unauthorized Credential Access Detection From AWS RDS LoginMedium Cross-tenant Access Settings Organization AddedMedium Cross-tenant Access Settings Organization DeletedMedium Cross-tenant Access Settings Organization Inbound Collaboration Settings ChangedMedium Cross-tenant Access Settings Organization Inbound Direct Settings ChangedMedium Cross-tenant Access Settings Organization Outbound Collaboration Settings ChangedMedium Cross-tenant Access Settings Organization Outbound Direct Settings ChangedMedium Dataverse - Guest user exfiltration following Power Platform defense impairmentHigh Dataverse - New non-interactive identity granted accessInformational Dataverse - Suspicious use of Web APIMedium Detect PIM Alert Disabling activityMedium Detecting Impossible travel with mailbox permission tampering & Privilege Escalation attemptMedium Distributed Password cracking attempts in Microsoft Entra IDMedium End-user consent stopped due to risk-based consentMedium End-user consent to app with mailbox and offline access delegated scopesHigh Expired access credentials being used in AzureMedium External guest invitation followed by Microsoft Entra ID PowerShell signinMedium F&O - Unusual sign-in activity using single factor authenticationLow Failed AWS Console logons but success logon to AzureADMedium Failed AzureAD logons but success logon to AWS ConsoleMedium Failed AzureAD logons but success logon to hostMedium Failed host logons but success logon to AzureADMedium Failed login attempts to Azure PortalLow Failed sign-ins into LastPass due to MFALow First access credential added to Application or Service Principal where no credential was presentHigh full_access_as_app Granted To ApplicationMedium GitHub Signin Burst from Multiple LocationsMedium GitLab - SSO - Sign-Ins BurstMedium GreyNoise TI Map IP Entity to SigninLogsMedium GSA - Detect Abnormal Deny Rate for Source to Destination IPMedium GSA - Detect Connections Outside Operational HoursHigh GSA - Detect Protocol Changes for Destination PortsMedium GSA - Detect Source IP Scanning Multiple Open PortsMedium GSA - TI Domain EntityMedium GSA - TI IP EntityMedium GSA - TI URL EntityMedium Guest accounts added in Entra ID Groups other than the ones specifiedHigh Guest Users Invited to Tenant by New InvitersMedium High risk Office operation conducted by IP Address that recently attempted to log into a disabled accountMedium High-Risk Cross-Cloud User ImpersonationMedium HoneyLabs TI Map IP Entity to SigninLogsMedium Insider Risk_Risky User Access By ApplicationMedium Insider Risk_Sensitive Data Access Outside Organizational Geo-locationHigh IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPNMedium Log4j vulnerability exploit aka Log4Shell IP IOCHigh Lumen TI IPAddress in IdentityLogonEventsMedium Lumen TI IPAddress in SigninLogsMedium Mail.Read Permissions Granted to ApplicationMedium Malformed user agentMedium MFA Rejected by UserMedium MFA Spamming followed by Successful loginHigh Microsoft Entra ID PowerShell accessing non-Entra ID resourcesLow Microsoft Entra ID Rare UserAgent App Sign-inMedium Microsoft Entra ID Role Management Permission GrantHigh Microsoft Entra ID UserAgent OS MissmatchMedium Modified domain federation trust settingsHigh Multi-Factor Authentication Disabled for a UserMedium Multiple admin membership removals from newly created admin.Medium Multiple Password Reset by userLow New access credential added to Application or Service PrincipalMedium New country signIn with correct passwordMedium New External User Granted Admin RoleMedium New onmicrosoft domain added to tenantMedium New User Assigned to Privileged RoleHigh NRT Authentication Methods Changed for VIP UsersMedium NRT First access credential added to Application or Service Principal where no credential was presentMedium NRT Modified domain federation trust settingsHigh NRT New access credential added to Application or Service PrincipalMedium NRT PIM Elevation Request RejectedHigh NRT Privileged Role Assigned Outside PIMLow NRT User added to Microsoft Entra ID Privileged GroupsMedium Password spray attack against ADFSSignInLogsMedium Password spray attack against Microsoft Entra ID applicationMedium Password spray attack against Microsoft Entra ID Seamless SSOMedium PIM Elevation Request RejectedHigh Possible AiTM Phishing Attempt Against Microsoft Entra IDMedium Possible SignIn from Azure BackdoorMedium Power Apps - App activity from unauthorized geoLow Power Apps - Bulk sharing of Power Apps to newly created guest usersMedium Power Platform - Account added to privileged Microsoft Entra rolesLow Power Platform - Possibly compromised user accesses Power Platform servicesHigh Privileged Account Permissions ChangedMedium Privileged Accounts - Sign in Failure SpikesHigh Privileged Role Assigned Outside PIMLow Privileged User Logon from new ASNMedium PRODAFT USTA - Compromised credential used in successful sign-inHigh Rare application consentMedium Risky user signin observed in non-Microsoft network deviceMedium Service Principal Assigned App Role With Sensitive AccessMedium Service Principal Assigned Privileged RoleMedium Service Principal Authentication Attempt from New CountryMedium Sign-ins from IPs that attempt sign-ins to disabled accountsMedium Speculus - Sign-in attempt from high-risk IP indicatorHigh Successful logon from IP and failure from a different IPMedium Suspicious application consent for offline accessLow Suspicious application consent similar to O365 Attack ToolkitHigh Suspicious application consent similar to PwnAuthMedium Suspicious Entra ID Joined Device UpdateMedium Suspicious linking of existing user to external UserMedium Suspicious Login from deleted guest accountMedium Suspicious modification of Global Administrator user propertiesMedium Suspicious Service Principal creation activityLow Suspicious Sign In Followed by MFA ModificationMedium Threat Essentials - Multiple admin membership removals from newly created admin.Medium Threat Essentials - NRT User added to Microsoft Entra ID Privileged GroupsMedium Threat Essentials - User Assigned Privileged RoleHigh ThreatConnect TI map Email entity to SigninLogsMedium TI map Email entity to SigninLogsMedium TI Map Email entity to SigninLogsMedium TI Map IP Entity to SigninLogsMedium TI Map IP Entity to SigninLogsMedium TI Map URL Entity to AuditLogsMedium TI Map URL Entity to AuditLogsMedium TI Map URL Entity to EmailUrlInfoMedium Unauthorized user access across AWS and AzureMedium Unusual Volume of file deletion by usersHigh URL Added to Application from Unknown DomainHigh User Account Created Using Incorrect Naming FormatLow User account created without expected attributes definedLow User Accounts - Sign in Failure due to CA SpikesMedium User Added to Admin RoleLow User added to Microsoft Entra ID Privileged GroupsMedium User agent search for log4j exploitation attemptHigh User Assigned New Privileged RoleHigh User State changed from Guest to MemberMedium [Deprecated] Explicit MFA DenyMedium [Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management PermissionsHigh [Entra ID] Application Granted Administrative Permission to Assign Microsoft Entra ID RolesHigh [Entra ID] Authentication Method Changed for Privileged AccountHigh [Entra ID] Domain Federation Trust Settings ModifiedHigh [Entra ID] Mass Privileged Role Change Activity DetectedHigh [Entra ID] Privilege Elevation Request DeniedHigh [Entra ID] Privileged Role Assigned to a New UserHigh [Entra ID] Privileged Role Assigned to UserHigh [Entra ID] Suspicious Continuous OAuth Token UsageHigh

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Microsoft Entra ID/Data Connectors/template_AzureActiveDirectory.JSON ↗
Commit: 7ca9800 ↗
Source identifier: AzureActiveDirectory

Additional source files 2

Solutions/Microsoft Entra ID/Data Connectors/template_AzureActiveDirectory.JSONsource ↗Solutions/Microsoft Entra ID/Data/Solution_AAD.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.