{"id":5056,"date":"2024-03-08T07:49:41","date_gmt":"2024-03-08T15:49:41","guid":{"rendered":"https:\/\/SUMMALAI.COM\/?p=5056"},"modified":"2024-03-08T07:49:43","modified_gmt":"2024-03-08T15:49:43","slug":"how-to-monitor-sign-in-of-emergency-access-accounts-in-microsoft-entra-id","status":"publish","type":"post","link":"https:\/\/SUMMALAI.COM\/?p=5056","title":{"rendered":"How to Monitor Sign-in of Emergency Access Accounts in Microsoft Entra ID"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>Quick Reference: <\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe title=\"How to create a sign in alert for an azure break glass account\" width=\"640\" height=\"360\" src=\"https:\/\/www.youtube.com\/embed\/1Zu-GhWAgYU?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"monitor-sign-in-and-audit-logs\">Monitor sign-in and audit logs<\/h2>\n\n\n\n<p>Organizations should monitor sign-in and audit log activity from the emergency accounts and trigger notifications to other administrators. When you monitor the activity on break glass accounts, you can verify these accounts are only used for testing or actual emergencies. You can use Azure Log Analytics to monitor the sign-in logs and trigger email and SMS alerts to your admins whenever break glass accounts sign in.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"obtain-object-ids-of-the-break-glass-accounts\">Obtain Object IDs of the break glass accounts<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the&nbsp;<a href=\"https:\/\/entra.microsoft.com\/\">Microsoft Entra admin center<\/a>&nbsp;as at least a&nbsp;<a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/permissions-reference#user-administrator\">User Administrator<\/a>.<\/li>\n\n\n\n<li>Browse to&nbsp;<strong>Identity<\/strong>&nbsp;&gt;&nbsp;<strong>Users<\/strong>&nbsp;&gt;&nbsp;<strong>All users<\/strong>.<\/li>\n\n\n\n<li>Search for the break-glass account and select the user\u2019s name.<\/li>\n\n\n\n<li>Copy and save the Object ID attribute so that you can use it later.<\/li>\n\n\n\n<li>Repeat previous steps for second break-glass account.<a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/security-emergency-access#create-an-alert-rule\"><\/a><\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-an-alert-rule\">Create an alert rule<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the&nbsp;<a href=\"https:\/\/portal.azure.com\/\">Azure portal<\/a>&nbsp;as at least a&nbsp;<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/role-based-access-control\/built-in-roles#monitoring-contributor\">Monitoring Contributor<\/a>.<\/li>\n\n\n\n<li>Browse to&nbsp;<strong>Monitor<\/strong>&nbsp;&gt;&nbsp;<strong>Log Analytics workspaces<\/strong>.<\/li>\n\n\n\n<li>Select a workspace.<\/li>\n\n\n\n<li>In your workspace, select\u00a0<strong>Alerts<\/strong>\u00a0>\u00a0<strong>New alert rule<\/strong>.<\/li>\n\n\n\n<li>Under&nbsp;<strong>Resource<\/strong>, verify that the subscription is the one with which you want to associate the alert rule.<\/li>\n\n\n\n<li>Under&nbsp;<strong>Condition<\/strong>, select&nbsp;<strong>Add<\/strong>.<\/li>\n\n\n\n<li>Select&nbsp;<strong>Custom log search<\/strong>&nbsp;under&nbsp;<strong>Signal name<\/strong>.<\/li>\n\n\n\n<li>Under\u00a0<strong>Search query<\/strong>, enter the following query, inserting the object IDs of the two break glass accounts.\u00a0NoteFor each additional break glass account you want to include, add another &#8220;or UserId == &#8220;ObjectGuid&#8221;&#8221; to the <\/li>\n\n\n\n<li>query.Sample queries:<code> <\/code><\/li>\n<\/ol>\n\n\n\n<p>\/\/ Search for a single Object ID (UserID)<br>SigninLogs<br>| project UserId<br>| where UserId == &#8220;f66e7317-2ad4-41e9-8238-3acf413f7448&#8221;<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>\/\/ Search for multiple Object IDs (UserIds)<br>SigninLogs<br>| project UserId<br>| where UserId == &#8220;f66e7317-2ad4-41e9-8238-3acf413f7448&#8221; or UserId == &#8220;0383eb26-1cbc-4be7-97fd-e8a0d8f4e62b&#8221;<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>\/\/ Search for a single UserPrincipalName<br>SigninLogs<br>| project UserPrincipalName<br>| where UserPrincipalName == &#8220;user@yourdomain.onmicrosoft.com&#8221;<\/p>\n\n\n\n<p><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Under\u00a0<strong>Alert logic<\/strong>, enter the following:\n<ul class=\"wp-block-list\">\n<li>Based on: Number of results<\/li>\n\n\n\n<li>Operator: Greater than<\/li>\n\n\n\n<li>Threshold value: 0<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Under&nbsp;<strong>Evaluated based on<\/strong>, select the&nbsp;<strong>Period (in minutes)<\/strong>&nbsp;for how long you want the query to run, and the&nbsp;<strong>Frequency (in minutes)<\/strong>&nbsp;for how often you want the query to run. The frequency should be less than or equal to the period.<img decoding=\"async\" src=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/media\/security-emergency-access\/alert-image2.png\" alt=\"alert logic\"><\/li>\n\n\n\n<li>Select&nbsp;<strong>Done<\/strong>. You may now view the estimated monthly cost of this alert.<\/li>\n\n\n\n<li>Select an action group of users to be notified by the alert. If you want to create one, see&nbsp;<a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/security-emergency-access#create-an-action-group\">Create an action group<\/a>.<\/li>\n\n\n\n<li>To customize the email notification sent to the members of the action group, select actions under&nbsp;<strong>Customize Actions<\/strong>.<\/li>\n\n\n\n<li>Under&nbsp;<strong>Alert Details<\/strong>, specify the alert rule name and add an optional description.<\/li>\n\n\n\n<li>Set the&nbsp;<strong>Severity level<\/strong>&nbsp;of the event. We recommend that you set it to&nbsp;<strong>Critical(Sev 0)<\/strong>.<\/li>\n\n\n\n<li>Under&nbsp;<strong>Enable rule upon creation<\/strong>, leave it set as&nbsp;<strong>yes<\/strong>.<\/li>\n\n\n\n<li>To turn off alerts for a while, select the&nbsp;<strong>Suppress Alerts<\/strong>&nbsp;check box and enter the wait duration before alerting again, and then select&nbsp;<strong>Save<\/strong>.<\/li>\n\n\n\n<li>Click&nbsp;<strong>Create alert rule<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p><a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/security-emergency-access#create-an-action-group\"><\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"create-an-action-group\">Create an action group<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Select&nbsp;<strong>Create an action group<\/strong>.<img decoding=\"async\" src=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/media\/security-emergency-access\/action-group-image3.png\" alt=\"create an action group for notification actions\"><\/li>\n\n\n\n<li>Enter the action group name and a short name.<\/li>\n\n\n\n<li>Verify the subscription and resource group.<\/li>\n\n\n\n<li>Under action type, select&nbsp;<strong>Email\/SMS\/Push\/Voice<\/strong>.<\/li>\n\n\n\n<li>Enter an action name such as&nbsp;<strong>Notify Global Administrator<\/strong>.<\/li>\n\n\n\n<li>Select the&nbsp;<strong>Action Type<\/strong>&nbsp;as&nbsp;<strong>Email\/SMS\/Push\/Voice<\/strong>.<\/li>\n\n\n\n<li>Select&nbsp;<strong>Edit details<\/strong>&nbsp;to select the notification methods you want to configure and enter the required contact information, and then select&nbsp;<strong>Ok<\/strong>&nbsp;to save the details.<\/li>\n\n\n\n<li>Add any additional actions you want to trigger.<\/li>\n\n\n\n<li>Select&nbsp;<strong>OK<\/strong>.<\/li>\n<\/ol>\n\n\n\n<p>Ref: <a href=\"https:\/\/learn.microsoft.com\/en-us\/entra\/identity\/role-based-access-control\/security-emergency-access\">Manage emergency access admin accounts &#8211; Microsoft Entra ID | Microsoft Learn<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Quick Reference: Monitor sign-in and audit logs Organizations should monitor sign-in and audit log activity from the emergency accounts and trigger notifications to other administrators. When you monitor the activity on break glass accounts, you can verify these accounts are only used for testing or actual emergencies. You can use Azure Log Analytics to monitor <a class=\"read-more\" href=\"https:\/\/SUMMALAI.COM\/?p=5056\">Read More<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_bbp_topic_count":0,"_bbp_reply_count":0,"_bbp_total_topic_count":0,"_bbp_total_reply_count":0,"_bbp_voice_count":0,"_bbp_anonymous_reply_count":0,"_bbp_topic_count_hidden":0,"_bbp_reply_count_hidden":0,"_bbp_forum_subforum_count":0,"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1249,238,239,10],"tags":[1770],"class_list":["post-5056","post","type-post","status-publish","format-standard","hentry","category-azure-microsoft","category-cloud","category-azure","category-microsoft","tag-monitor-sign-in-of-emergency-access-accounts-in-microsoft-entra-id"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/5056","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5056"}],"version-history":[{"count":1,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/5056\/revisions"}],"predecessor-version":[{"id":5057,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=\/wp\/v2\/posts\/5056\/revisions\/5057"}],"wp:attachment":[{"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5056"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5056"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/SUMMALAI.COM\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5056"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}