Passwordless sign-in on Azure Sentinel logs

Question

I would like to know how to spot in Sentinel sign-in logs the kind of sign-in a user has performed when they login to their account i.e., is it with credentials including password or a passwordless sign in may be through a security key or Microsoft Authenticator/ Azure AD.

Answer 1

@Taiwo Oyewo Just wanted to check if the above mentioned suggestion by our expert has helped or not regarding your issue.

Also you can review this article https://www.jasonsamuel.com/2020/05/21/how-to-report-on-microsoft-authenticator-password-less-phone-sign-in-fido2-security-key-usage-using-azure-ad-azure-monitor-log-analytics/ talks about similar ask which you are looking for.

Let me know if you have any further questions.

Please remember to "Accept Answer" if any of the answer helped, so that others in the community facing similar issues can easily find the solution.

Answer 2

There are lots of examples in the Sentinel github: https://github.com/Azure/Azure-Sentinel/blob/168ecf545130aca8756ef0cdd36a7f0c17d1ab64/Solutions/Azure%20Active%20Directory/Analytic%20Rules/FailedLogonToAzurePortal.yaml which you could use as a starting point