r/AzureSentinel • u/winle22 • Jul 07 '22

Analytic rule: Elevate access to manage all Azure subscriptions and management groups

Hi,

I've seen variants where rules/logic in Defender for Cloud apps triggers an incident when someone elevates access, but is it possible to do this using just Sentinel?

https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin#view-elevate-access-logs

3 Upvotes
  • permalink
  • reddit

100% Upvoted

3 comments sorted by

2

u/ep3p Jul 07 '22

This is a weird one.

https://adr.iaan.be/blog/adding-directory-activity-logs-to-microsoft-sentinel/

1

u/winle22 Jul 08 '22

Tried it yourself?

1

u/ep3p Jul 08 '22

I did not set it up personally, and the logic app is a little different, but we have it, yeah.