Filtering Alerts for Activity type ElevateAccess Microsoft.Authorization

[thezero]

Hello guys

I was playing around with Microsoft Defender for Cloud Apps and Power Automate and created a policy in MDCA for detecting the usage of the elevate access option in Azure Active Directory.

The problem I'm having is that when the policy for that activity is triggered it creates two alerts one with the description: "ElevateAccess Microsoft.Authorization: resource /providers/Microsoft.Authorization - Started" and one with "ElevateAccess Microsoft.Authorization: resource /providers/Microsoft.Authorization - Succeded".

That in itself wouldn't be a problem but if the policy is connected with a Power Automate Flow said Flow triggers two times for basically the same event.

Now my question is if any of you have an idea on how to solve this problem? I tried filtering for the activity objects the alert provides but that didn't work.

best regards 

thezero 

[#2]

The only solution I can think of is to extract the additional activity data from the alert's 'entities' field and then use some Power Automate logic to only act when it is the second event which is the success indicator.

[#3]

Sadly, the cloud app security trigger in power automate doesn't provide the data from the alert's entities field. And I don't know how else I would retrieve that data.