Échangeons
← Sentinel Explorer
↳ Source GitHubSolution

Microsoft Entra ID

Voir sur GitHub ↗Fichier original ↗

Description

The [Microsoft Entra ID](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-whatis) solution for Microsoft Sentinel enables you to ingest Microsoft Entra ID [Audit](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-audit-logs), [Sign-in](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-sign-ins), [Provisioning](https://docs.microsoft.com/azure/active-directory/reports-monitoring/concept-provisioning-logs), [Risk Events and Risky User/Service Principal](https://docs.microsoft.com/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk#risky-users) logs using Diagnostic Settings into Microsoft Sentinel.
Version
3.3.17
Auteur / éditeur déclaré
Microsoft - support@microsoft.com
Niveau de support
Microsoft

Sources déclarées

Métadonnées du fichier source. Aucune dépendance déduite du KQL.

Connecteurs

AzureActiveDirectory

Contenus associés

Liens établis à partir des identifiants déclarés et des manifests des solutions.

Règles analytiques74
Account Created and Deleted in Short TimeframeHighAccount created or deleted by non-approved userMediumAdmin promotion after Role Management Application Permission GrantHighAnomalous sign-in location by user account and authenticating applicationMediumAttempt to bypass conditional access rule in Microsoft Entra IDLowAttempts to sign in to disabled accountsMediumAuthentication Methods Changed for Privileged AccountHighAzure Portal sign in from another Azure TenantMediumAzure RBAC (Elevate Access)HighBrute force attack against an Entra-authenticated Windows deviceMediumBrute force attack against Azure PortalMediumBrute Force Attack against GitHub AccountMediumBulk Changes to Privileged Account PermissionsHighConditional Access - A Conditional Access app exclusion has changedLowConditional Access - A Conditional Access Device platforms condition has changed (the Device platforms condition can be spoofed)LowConditional Access - A Conditional Access policy was deletedLowConditional Access - A Conditional Access policy was disabledLowConditional Access - A Conditional Access policy was put into report-only modeLowConditional Access - A Conditional Access policy was updatedInformationalConditional Access - A Conditional Access user/group/role exclusion has changedHighConditional Access - A new Conditional Access policy was createdInformationalConditional Access - Dynamic Group Exclusion ChangesHighCredential added after admin consented to ApplicationMediumCross-tenant Access Settings Organization AddedMediumCross-tenant Access Settings Organization DeletedMediumCross-tenant Access Settings Organization Inbound Collaboration Settings ChangedMediumCross-tenant Access Settings Organization Inbound Direct Settings ChangedMediumCross-tenant Access Settings Organization Outbound Collaboration Settings ChangedMediumCross-tenant Access Settings Organization Outbound Direct Settings ChangedMediumDistributed Password cracking attempts in Microsoft Entra IDMediumEnd-user consent to app with mailbox and offline access delegated scopesHighExternal guest invitation followed by Microsoft Entra ID PowerShell signinMediumFailed login attempts to Azure PortalLowFirst access credential added to Application or Service Principal where no credential was presentHighfull_access_as_app Granted To ApplicationMediumGitHub Signin Burst from Multiple LocationsMediumGuest accounts added in Entra ID Groups other than the ones specifiedHighMail.Read Permissions Granted to ApplicationMediumMFA Rejected by UserMediumMFA Spamming followed by Successful loginHighMicrosoft Entra ID PowerShell accessing non-Entra ID resourcesLowMicrosoft Entra ID Role Management Permission GrantHighModified domain federation trust settingsHighMultiple admin membership removals from newly created admin.MediumNew access credential added to Application or Service PrincipalMediumNew onmicrosoft domain added to tenantMediumNew User Assigned to Privileged RoleHighNRT Authentication Methods Changed for VIP UsersMediumNRT First access credential added to Application or Service Principal where no credential was presentMediumNRT Modified domain federation trust settingsHighNRT New access credential added to Application or Service PrincipalMediumNRT PIM Elevation Request RejectedHighNRT Privileged Role Assigned Outside PIMLowNRT User added to Microsoft Entra ID Privileged GroupsMediumPassword spray attack against ADFSSignInLogsMediumPassword spray attack against Microsoft Entra ID applicationMediumPassword spray attack against Microsoft Entra ID Seamless SSOMediumPIM Elevation Request RejectedHighPossible SignIn from Azure BackdoorMediumPrivileged Accounts - Sign in Failure SpikesHighPrivileged Role Assigned Outside PIMLowRare application consentMediumSign-ins from IPs that attempt sign-ins to disabled accountsMediumSuccessful logon from IP and failure from a different IPMediumSuspicious application consent for offline accessLowSuspicious application consent similar to O365 Attack ToolkitHighSuspicious application consent similar to PwnAuthMediumSuspicious Entra ID Joined Device UpdateMediumSuspicious Service Principal creation activityLowSuspicious Sign In Followed by MFA ModificationMediumUser Accounts - Sign in Failure due to CA SpikesMediumUser added to Microsoft Entra ID Privileged GroupsMediumUser Assigned New Privileged RoleHigh[Deprecated] Explicit MFA DenyMedium
Connecteurs1
Workbooks3

Traçabilité de la source

GitHub

Les valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.

Identifiant source
azure-sentinel-solution-azureactivedirectory
Autres fichiers source 2Solutions/Microsoft Entra ID/Data/Solution_AAD.jsonsolution-manifest ↗Solutions/Microsoft Entra ID/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / SUIVI DU CATALOGUE

Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC

Dates de synchronisation GSTEP, distinctes des dates de publication du contenu source.