Feb 05 2021 04:03 PM
Feb 09 2021 03:07 PM - edited Feb 09 2021 03:07 PMSolution
Hi i'm assuming that you have already Log analytics and you have integrated Azure AD logs
If not you can to your directory blade
In the monitoring section go to Sign-ins and then Export Data Settings .
You will be able to add the following diagnostic settings :
Click on +Add diagnostic setting
Give a name to the diagnostic setting
In the category details Select at least Audit Logs and SignLogs
In the Destination select at least Send to Log Analytics workspace ( if it's a prod subscription i strongly recommend to archive the logs also ) .
Then select the subscription and an existing workspace will be populated .If not you have to create it.
Once done Azure Monitor blade
Go to alerts then click on New alert rule
In the Scope section select the resource that should be the log analytics where you are sending the Azure Active Directory logs
In the condition section you configure the signal logic as Custom Log Search ( by default 6 evaluations are done in 30 min but you can customize the time range .
In the search query block copy paste the following query (formatted) :
| where OperationName in ('Add member to group', 'Add owner to group', 'Remove member from group', 'Remove owner from group')
For the alert logic put 0 for the value of Threshold and click on done .
Now the alert need to be send to someone or a group for that
you can configure and action group where notification can be Email/SMS message/Push/Voice
The action type can be Automation Runbook ITSM Webhook ...
Finally you can define the alert rule details (example in attached files)
Once done you can do the test to verify if you can have a result to your query
Add a member to a group and remove it
Add an owner to a group and remove it
You should receive an email like the one in attachments
Hope that will help if yes you can mark it as anwser