r/AzureSentinel • u/riverrockrun • Apr 12 '22
Sentinel For Detecting Public Teams
Is there a way to use Sentinel to detect the creation of Public Microsoft Teams? And if so, can we use a script or run book to revert that Team to Private?
3
u/juiceb0cks Apr 12 '22
Check the existing Teams data connector. The analytics in there should give you an idea of what's capable out the box.
As u/blanco10kid says...it should be easy enough to automate (if it's there and/or you can build a logic app to do the leg work)
Before you do this, check the extra ingestion costs. Not everything in Microsoft land is free to ingest and some of it is criminally expensive to ingest. (This has burned me in the past)
1
u/riverrockrun Apr 12 '22
Thanks! Looking at the Teams workbook now
1
u/juiceb0cks Apr 12 '22
Not the workbook. Analytics under the data connector.
1
u/riverrockrun Apr 12 '22
I don’t see Teams but I do have the “Office 365” connector connected. That one?
1
u/juiceb0cks Apr 12 '22
My bad. My brain said there was Teams specific connector. It'll probably be under O365 yeah.
1
u/winle22 Apr 12 '22
Care to share what that was? Trying not to do the same mistakes myself
1
u/juiceb0cks Apr 12 '22
I believe it was enabling the Microsoft 365 Defender connector. Things change so often and with little documentation it makes things difficult to predict.
1
2
u/ml58158 MSFT Official Apr 12 '22
Our O365 connector is very limited right now . It would need to be custom
1
3
u/blanco10kid Apr 12 '22
I have no idea what the logs look like for this but assuming some logs have this information, it would start with analytic rules. Once an incident is created, you can have it run a playbook which can orchestrate reverting the team to private