Guidance on process and logging

%3CLINGO-SUB%20id%3D%22lingo-sub-1114501%22%20slang%3D%22en-US%22%3EGuidance%20on%20process%20and%20logging%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1114501%22%20slang%3D%22en-US%22%3E%3CP%3EI%20am%20after%20some%20guidance%20and%20information%20on%20the%20process%20logins%20take.%20By%20this%20I%20mean%20things%20like%20is%20what%20is%20evaluated%20first%3F%20If%20I%20login%2C%20when%20is%20conditional%20access%20evaluated%3F%20When%20does%20the%20login%20appear%20in%20the%20Azure%20AD%20logs.%20Does%20this%20vary%20depending%20on%20the%20protocol%20I%20use%2C%20i.e.%20if%20I%20have%20basic%20auth%20off%20when%20does%20a%20POP%20request%20get%20rejected%3F%20I'd%20like%20to%20know%20what%20gets%20evaluated%20when%20during%20the%20login%20process.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI'd%20also%20like%20to%20better%20understand%20when%20something%20appears%20in%20the%20log.%20If%20I%20have%20an%20alert%20for%20impossible%20travel%20in%20MCAS%20say%2C%20after%20that%20is%20tripped%20how%20long%20is%20it%20before%20I%20receive%20a%20notification%3F%20is%20there%20any%20documentation%20on%20how%20long%20alerts%20from%20different%20processes%20take%20from%20incident%20to%20display%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E
MVP

I am after some guidance and information on the process logins take. By this I mean things like is what is evaluated first? If I login, when is conditional access evaluated? When does the login appear in the Azure AD logs. Does this vary depending on the protocol I use, i.e. if I have basic auth off when does a POP request get rejected? I'd like to know what gets evaluated when during the login process.

 

I'd also like to better understand when something appears in the log. If I have an alert for impossible travel in MCAS say, after that is tripped how long is it before I receive a notification? is there any documentation on how long alerts from different processes take from incident to display?

0 Replies