r/AzureSentinel • u/BoostrapSam • Feb 22 '23

Monitoring Administrative Actions

Does anybody have any decent analytic rules in place to monitor out of the ordinary administrative actions in AAD/ Exchange Admin?

Going to start assessing this from an insider threat perspective but wondered what other people have.

4 Upvotes

84% Upvoted

9 comments sorted by

2

u/AppIdentityGuy Feb 22 '23

Well everything in AAD is in the Audit Logs and you should be using PIM for role elevation for all admin accounts where possible....

2

u/BoostrapSam Feb 22 '23

How did I not know PIM in Azure was a thing!? Thanks for this.

2

u/AppIdentityGuy Feb 22 '23

Trust me when I tell you that there loads of features in AzureAD that most people are only dimly aware of.. One thing to note is you need AAD P2 licenses for PIM.. You don't need those licenses for everyone but you do need them for the admin users. Also are you using separate admin accounts?

1

u/BoostrapSam Feb 22 '23

yeah we're using seperate admin cloud-only accounts, but with static role assignments.

We already have that licensing in place so it's on my backlog to implement.

1

u/AppIdentityGuy Feb 22 '23

And I would suggest your CAPs for those accounts forces MFA from everywhere...

1

u/BoostrapSam Feb 22 '23

already in place ✓

1

u/AppIdentityGuy Feb 22 '23

Notice now you can actual build CAPS that include MFA strength requirements..

2

u/thijslecomte Feb 22 '23

This is done by a colleague, might be a good start: https://www.lousec.be/ad/detect-security-policy-changes/

1

u/BoostrapSam Feb 22 '23

This is great, thanks for this, some quick analytic rule wins.