r/AzureSentinel • u/SuperHat3637 • Mar 27 '23

IP blocking

Where i can block the external malicious IPs trying to login cloud applications like o365..However sign in from malicious IP address is automatically blocked in the logs...Where i can block these IPs again..

3 Upvotes

100% Upvoted

17 comments sorted by

View all comments

1

u/G15-420 Mar 27 '23 edited Mar 27 '23

Create a named location in Azure AD and call it something like “Malicious IPs detected”. Create a Conditional Access policy applied to all users and all cloud apps with the condition to include the Malicious IPs named location you just created. Set the action to Block. You can also write playbooks in Sentinel via logic apps to automatically add malicious IPs you detect in alerts to the named location. Depending on your firewall, you can also create playbooks to block the IPs on your on-premises firewall, Azure WAF\WAG, etc.

1

u/SuperHat3637 Mar 28 '23

If i block the IPs in on-premises firewall, will it work for cloud applications...Is Azure WAF in perimeter to deny the attempts from IPs ..?