Passwords from AAD - not visible?

[David Caddick]

I am trying to drill in Password information in Sentinel and when searching the Schema it comes up with a list focused on AADDomainServices...  and yet we can see that both Azure Active Directory & the Azure Activity connecters are connected and providing data - is there something we are missing here?

[#2 · Accepted solution]

https://docs.microsoft.com/en-gb/azure/azure-monitor/log-query/logs-structure The data is from two sources, one AAD one from Azure Security Center (SecurityInsights), the column names happen to be the same.

[#3]

Thanks @CliveWatson,

If I already have AAD connected then how come I can't find it returning any details at all? ;-(

I'd like to be able to do a quick check on "PasswordLastSet" and in the end I've had to resort to Powershell instead of Sentinel