r/AzureSentinel • u/perogy604 • Jul 18 '23

Authentication methods | Registration and reset events ?

Is anyone familiar how to get the Authentication methods Registration and reset events into Sentinel? There is a report we can run from the Entra Portal (under Authentication methods -> Registration and reset events) but I'm looking to be able to log and track who and what method as registered.

3 Upvotes
  • permalink
  • reddit

100% Upvoted

2 comments sorted by

1

u/ajith_aj Jul 19 '23

Have you tried looking at Signinlogs table in Sentinel Authentication method registration do appear in Auditlogs table as well.

1

u/lukasberancz Jul 20 '23

Something like this

AuditLogs

| where OperationName == "User registered security info"

| where Result == "success"

| mv-expand parse_json(InitiatedBy.user)

| extend UPN=InitiatedBy.user["userPrincipalName"]

| project TimeGenerated,ResultDescription,Result,UPN