Configuring Azure AD to notify for leaked credentials ?

Question

Hi All,

According to: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs
I need to enable PHS, to be able to leverage leaked credentials notification.

How can I get the notification by email to specific address like SOC@keyman .net ?

I am using Hybrid Azure AD and OnPremise AD DS sync (Azure AD Connect) with the PHS feature enabled.
I also have ADFS 4.0 OnPremise (Windows Server 2016).

Thanks in advance.

Answer 1

In that case, I would implement the policies to protect your tenant and users:
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-policies

You can investigate:
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-investigate-risk

or output:

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-export-risk-data

Answer 2

Do you have the correct licensing?
The way to handle this is with Identity Protection and Conditional Access policies that force a password change or block in the event an account has leaked creds:

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

Answer 3

Hello,

You can configure inside identity protection "users at risk detected alerts" as below and in this article :

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications

The other option can be to use log ingestion from Azure AD to a log analytics and do some KQL to create an alert when leaked credential risk is raised

Answer 4

Right, you dont notify the user, you force them to change their password using Conditional Access

The notification typically goes to an admin or group that may find it useful :)

see the picture and location of that that ClmentBETACORNE-2996 posted earlier

Answer 5

@Andy David - MVP & @ClmentBETACORNE-2996 I've got the setup like below:

How to setup to notify the user with the leaked credentials and CC: Security@keyman .com ?

Does enabling the below two options:
Enforce policy On

and then:

is sufficient to allow the impacted user to reset their own password via SSPR ?
assuming the Password Write-back is enabled also.