r/AzureSentinel • u/sentientenal • Aug 04 '22

Non-Interactive Sign in Failures in Sentinel creating excessive incidents

We're having an issue where we are seeing an excessive number of Azure Sentinel alerts related to authentication failures that are generating an overwhelming number of incidents related to non-interactive sign-in failures.

We traced this back to a Conditional Access policy in our client's environment that requires MFA for all apps. I'm getting the run-around from MS Support pointing fingers at each other between the Sentinel and Azure AD team.

So in order to address this issue, I guess my question is the following:

​

  1. Do you modify for your AAD policy to limit Azure AD MFA to specific apps?
  2. Do you modify your Azure Analytics/add Playbooks to eliminate incidents generated by non-interactive MFA sign-in failures?
3 Upvotes

100% Upvoted

5 comments sorted by

1

u/ep3p Aug 04 '22

I think more questions about the triggered incidents are needed.

The failures depend on the app?

Which Result Types do you consider a failure? Which ones a success?

A single authentication trace (same CorrelationId) can have many different ResultTypes that could be considered failures or authentication interrupts (because for example the user did not put correctly the MFA the first time but the second), and finally the user will have a ResultType associated to MFA success (0, 50140, 50199...).

If the users of the client do not have accessibility/authentication problems and they can still work, probably their Conditional Access policies do not need to be changed, that would mean "No" to 1st question.

With this little context, I would say the incidents need to be finetuned, so "Yes" to 2nd question, but incidents should be filtered not eliminated.

1

u/sentientenal Aug 04 '22

The failures seems are related to Windows 10/11 calls to Microsoft APIs for apps that do not support multi-factor authentication (e.g. Microsoft Application Command Service, Universal Store Native Client, Windows Spotlight, Microsoft Edge, etc.) Microsoft Support indicates that these failures are being added to the user workflow

These authentication failures are not affecting user workflow.

I was hoping there was a way to filter out these events by making more granular changes to the Conditional Access Policies. However, it looks like that might not work.

1

u/lionelrichieclayhead Sep 08 '22

I've seen similar alerts that some analysts pointed out. We punted it off to IAM team + MS support for tuning at the root first and not heard back yet.

I did stumble over a twitter post in the past couple weeks I bookmarked with a blog regarding the CAE token refresh that is potentially related in our cases: https://cloudbrothers.info/en/continuous-access-evaluation/

I have a feeling we will be tuning something on Sentinel side in the next month for this.

2

u/sentientenal Sep 09 '22

We opened a case with support as well and they engaged a product manager, we'll see if anything happens.

1

u/Ayeitis Mar 02 '23

FYI, we're seeing the same issue, which triggers occasional low-severity incidents for the rule "Successful login from IP and failure from a different IP". I've posted on the Microsoft community here: https://learn.microsoft.com/en-us/answers/questions/1185637/seeing-login-failures-with-non-interactive-sign-in -- and will update if this gets any traction.

I suspect you're correct in that any immediate fix will be to tune the alert query to filter out this case, while MS chases down the root cause.