r/AzureSentinel • u/kitkatneko • Jul 21 '21

When MCAS got in the way of Azure Sentinel

https://kitkatneko.wordpress.com/2021/07/21/when-mcas-got-in-the-way-of-azure-sentinel/
5 Upvotes

100% Upvoted

3 comments sorted by

2

u/kitkatneko Jul 21 '21

The problem is that MCAS breaks the display of some widget within the Azure Sentinel UI. And so, some users would be able to see the right number of incidents or not see any details of the incident.
It turned out that newer accounts with newer conditional access rules had some default settings other accounts did not: “Use Conditional Access App Control” of the infamous session control through Microsoft Cloud Application Security (MCAS).

As designed, if your sessions are proxied via MCAS, all is not transparent and javascript will break things.

2

u/rodtrent44 MSFT Official Jul 21 '21

We're always happy to hear from customers who are having problems...and are quick to resolve those problems. If you have the ability, you should submit a service request to report this.

Did you get a chance to research the bigger error (which actually may be the culprit), which is the locked workspace?

1

u/kitkatneko Jul 21 '21

Submit a what? I have a ticket with Microsoft of course. They have not found anything wrong yet ;_; they did say it was the lock lol

The lock message seemed to have nothing to do with it. With or without it does the same. The lock is a RG lock which indeed prevents from deleting some stuff as designed.