Blog Post

Microsoft Sentinel Blog
7 MIN READ

Enriching Azure Sentinel with Azure AD information

Chris Boehm's avatar
Chris Boehm
Former Employee
Apr 10, 2020
Howdy Everyone!   As organizations are migrating over to Azure Sentinel as their primary SIEM solution, they are looking at ways to enrich their data. For example associating Azure Activity logs ...
Updated Nov 03, 2021
Version 9.0
microsoft sentinel
security
Chris Boehm's avatar
Former Employee
Joined October 24, 2017
View Profile
Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Microsoft Sentinel by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

StevieLamb's avatar
StevieLamb
Copper Contributor
Apr 21, 2023

Very useful article, thanks!

 

Hds did you use the AzureAD module, or the Az.Accounts module to gather the data?

If the former, given its upcoming deprecation, are you switching to Microsoft.Graph.Users, or another method?

 

'm about to create a similar Runbbok but of course if I can re-use someone's already-functioning effort it will save some time! 🙂 Will be taking the extra advice on data purging onboard too.