Get in touch
← Sentinel Explorer
↳ GitHub sourceSolution

Microsoft Entra ID

View on GitHub ↗Original file ↗

Description

The [Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) solution for Microsoft Sentinel enables you to ingest Microsoft Entra ID [Audit](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs), [Sign-in](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins), [Provisioning](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-provisioning-logs), [Risk Events and Risky User/Service Principal](https://docs.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users) logs using Diagnostic Settings into Microsoft Sentinel.
Version
3.3.17
Declared author / publisher
Microsoft - support@microsoft.com
Support tier
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

AzureActiveDirectory

Related content

Links established from declared identifiers and solution manifests.

Analytics rules74
Account Created and Deleted in Short TimeframeHighAccount created or deleted by non-approved userMediumAdmin promotion after Role Management Application Permission GrantHighAnomalous sign-in location by user account and authenticating applicationMediumAttempt to bypass conditional access rule in Microsoft Entra IDLowAttempts to sign in to disabled accountsMediumAuthentication Methods Changed for Privileged AccountHighAzure Portal sign in from another Azure TenantMediumAzure RBAC (Elevate Access)HighBrute force attack against an Entra-authenticated Windows deviceMediumBrute force attack against Azure PortalMediumBrute Force Attack against GitHub AccountMediumBulk Changes to Privileged Account PermissionsHighConditional Access - A Conditional Access app exclusion has changedLowConditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)LowConditional Access - A Conditional Access policy was deletedLowConditional Access - A Conditional Access policy was disabledLowConditional Access - A Conditional Access policy was put into report-only modeLowConditional Access - A Conditional Access policy was updatedInformationalConditional Access - A Conditional Access user/group/role exclusion has changedHighConditional Access - A new Conditional Access policy was createdInformationalConditional Access - Dynamic Group Exclusion ChangesHighCredential added after admin consented to ApplicationMediumCross-tenant Access Settings Organization AddedMediumCross-tenant Access Settings Organization DeletedMediumCross-tenant Access Settings Organization Inbound Collaboration Settings ChangedMediumCross-tenant Access Settings Organization Inbound Direct Settings ChangedMediumCross-tenant Access Settings Organization Outbound Collaboration Settings ChangedMediumCross-tenant Access Settings Organization Outbound Direct Settings ChangedMediumDistributed Password cracking attempts in Microsoft Entra IDMediumEnd-user consent to app with mailbox and offline access delegated scopesHighExternal guest invitation followed by Microsoft Entra ID PowerShell signinMediumFailed login attempts to Azure PortalLowFirst access credential added to Application or Service Principal where no credential was presentHighfull_access_as_app Granted To ApplicationMediumGitHub Signin Burst from Multiple LocationsMediumGuest accounts added in Entra ID Groups other than the ones specifiedHighMail.Read Permissions Granted to ApplicationMediumMFA Rejected by UserMediumMFA Spamming followed by Successful loginHighMicrosoft Entra ID PowerShell accessing non-Entra ID resourcesLowMicrosoft Entra ID Role Management Permission GrantHighModified domain federation trust settingsHighMultiple admin membership removals from newly created admin.MediumNew access credential added to Application or Service PrincipalMediumNew onmicrosoft domain added to tenantMediumNew User Assigned to Privileged RoleHighNRT Authentication Methods Changed for VIP UsersMediumNRT First access credential added to Application or Service Principal where no credential was presentMediumNRT Modified domain federation trust settingsHighNRT New access credential added to Application or Service PrincipalMediumNRT PIM Elevation Request RejectedHighNRT Privileged Role Assigned Outside PIMLowNRT User added to Microsoft Entra ID Privileged GroupsMediumPassword spray attack against ADFSSignInLogsMediumPassword spray attack against Microsoft Entra ID applicationMediumPassword spray attack against Microsoft Entra ID Seamless SSOMediumPIM Elevation Request RejectedHighPossible SignIn from Azure BackdoorMediumPrivileged Accounts - Sign in Failure SpikesHighPrivileged Role Assigned Outside PIMLowRare application consentMediumSign-ins from IPs that attempt sign-ins to disabled accountsMediumSuccessful logon from IP and failure from a different IPMediumSuspicious application consent for offline accessLowSuspicious application consent similar to O365 Attack ToolkitHighSuspicious application consent similar to PwnAuthMediumSuspicious Entra ID Joined Device UpdateMediumSuspicious Service Principal creation activityLowSuspicious Sign In Followed by MFA ModificationMediumUser Accounts - Sign in Failure due to CA SpikesMediumUser added to Microsoft Entra ID Privileged GroupsMediumUser Assigned New Privileged RoleHigh[Deprecated] Explicit MFA DenyMedium
Connectors1
Workbooks3

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
azure-sentinel-solution-azureactivedirectory
Additional source files 2Solutions/Microsoft Entra ID/Data/Solution_AAD.jsonsolution-manifest ↗Solutions/Microsoft Entra ID/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.