Alert when Admin logs into Azure

Dels

8/5/23, 4:06 AM

I setup an Office365/Azure tenancy for a small charity I help. I am keen to setup automated reporting that sends an email when someone logs in as an admin account (i.e with a particular role or group).

The main things I am trying to achieve are

Visibility of when a 3rd party support organisation logging in to change the tenancy
Visibility of when an internal staff member logs in, including staff who have moved on and we believe their accounts are disabled
Visibility of unknown accounts logging in (i.e. a newly created admin account by a nefarious actor)

All I have been able to find is how to alert on a specific user, which can help with the first 2 requirements (although it means setting up an alert per account), however it doesn't cover the 3rd requirement.

Is it possible to setup an alert in Azure to send an email to a nominated address when any account with the Global Admin role logs in ?

0 + 0

security

azure

alert

administrative-privileges

djdomi

8/5/23, 5:44 AM

maybe my script can help in one point https://github.com/djdomi/Powershell-Scripts/blob/main/powershell_announce_failed_logins.ps1

Dels

8/5/23, 8:05 AM

Thanks @djdomi, I think your script runs on domain controller to harvest that information from event logs. * Note that I probably left out the key point that I'm not looking for logins to machines, just to logins to the Office365 / Azure platforms. As such, I'm looking for the platform to create an alert from a platform log. i.e. Microsoft numerous services covering SEIM, Monitoring, Security services etc, so I'm very much hoping my use case of easily reporting on admin logins, should be available out of the box, but I can't find it.Hence my question to the community for Azure expertise.

Score:0

Server

Sam Cogan

8/13/23, 11:04 AM

Azure AD Sign-In logs contain the information you need to detect when someone signs in. You can export these logs to a Log Analytics workspace and then setup an alert for when someone signs in with a Global Admin role.

This article has some step-by-step details on how it can be done.

0 + 0

Dels

9/4/23, 10:45 PM

Thanks for your response. That link shows how to monitor for a specific account. i.e. "I want to know when user X or Y logs in." What I'm looking for is "I want to know when a user, who I do not know the username, but has role ABC logs in". * I am trying to safeguard against unknown accounts being created and given admin roles by a bad actor. * Alternatively I can setup a powershell scipt to download accounts and memberships and email, but this seems very old school and I'd hoped Azure could help. Any ideas on being able to do this from Azure would be most appreciated :)

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Alert when Admin logs into Azure

TH: แจ้งเตือนเมื่อผู้ดูแลระบบเข้าสู่ระบบ Azure

RO: Alertă când administratorul se conectează la Azure

RU: Оповещение, когда администратор входит в Azure

VI: Cảnh báo khi Admin đăng nhập Azure

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.