Forum Discussion
gd-29
May 11, 2020Brass Contributor
Conditional Access Reporting
are there any built in conditional access reporting for changes to the policy? any way to alert or report when the policy changes and who made the change?
- May 12, 2020
gd-29 You can use Log Analytics to create your own alerts I've found following article how to implement your custom alerts: https://tech.nicolonsky.ch/conditional-access-and-azure-log-analytics-in-harmony/
They also requested this feature on uservoice but it's still not implemented: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/19331617-change-tracking-for-conditional-access-policies
You can also use Azure Sentinel. connect your Azure AD Data Connector: https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory
And implement your own Rules
JordyBlommaert
May 12, 2020Brass Contributor
gd-29 You can use Log Analytics to create your own alerts I've found following article how to implement your custom alerts: https://tech.nicolonsky.ch/conditional-access-and-azure-log-analytics-in-harmony/
They also requested this feature on uservoice but it's still not implemented: https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/19331617-change-tracking-for-conditional-access-policies
You can also use Azure Sentinel. connect your Azure AD Data Connector: https://docs.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory
And implement your own Rules
gd-29
May 13, 2020Brass Contributor
JordyBlommaert thanks!
this is a huge improvement. whats interesting is the querys from azure audit logs are way easier to see who made a change to the policy, but doesn't show what the change was (even though there is a new and old value field, its not accurate).
the data we collect in splunk shows the policy as its changed (not the old values), but doesn't seem to have the account that changed it, it shows some random API accounts. i'm assuming these are log entries from a backend process that we are capturing once you make the change in the website.
i'll post back if i get this in a better place.