IPaddress showing null value for User submitted their user ID step in passwordreset activity.

Question

IPaddress showing null value for User submitted their user ID step in passwordreset activity.

Ashok 1

Hi,

I'm trying to perform password reset from a vpn IP to test whether I can detect password reset attempts from unknown IP's from azure sentinel. As checked from AuditLogs table I couldn't see IpAddress value instead it is showing null

why azure SSPR behaviour unable to detect the IP value.

James Hamil 27,211 Reputation points Microsoft Employee Moderator

2021-01-19T20:58:45.413+00:00

Hi, has this worked for you in the past and has now stopped, or is this the first time you've tried this? Have you looked at this document?
Ashok 1 Reputation point

2021-01-19T21:07:41.907+00:00

Hi

This is the first time I'm working on this. But for some requests its being shown. For most of the requests its not showing. Can you guide me how can i utilize the link you referred to me.

My goal is to detect suspicious password reset attempts from suspicious IP addresses. But the auditlogs are not showing the IP itself. How can i fix this?
Ashok 1 Reputation point

2021-01-19T21:09:43.233+00:00

I even looked at the old logs still they are looking same no change observed. I'm working on "Multiple Password Reset" alert from a long time. But today I tried to write a new rule then i observed the initiatedby field is not showing the iPaddress.
James Hamil 27,211 Reputation points Microsoft Employee Moderator

2021-01-19T23:55:14.547+00:00

Hi, I'm looking into this with our escalations group. I'll let you know what I find!

Best,
James

1 answer

Your answer

James Hamil 27,211 Reputation points Microsoft Employee Moderator

2021-01-19T20:58:45.413+00:00

Hi, has this worked for you in the past and has now stopped, or is this the first time you've tried this? Have you looked at this document?
Ashok 1 Reputation point

2021-01-19T21:07:41.907+00:00

Hi

This is the first time I'm working on this. But for some requests its being shown. For most of the requests its not showing. Can you guide me how can i utilize the link you referred to me.

My goal is to detect suspicious password reset attempts from suspicious IP addresses. But the auditlogs are not showing the IP itself. How can i fix this?
Ashok 1 Reputation point

2021-01-19T21:09:43.233+00:00

I even looked at the old logs still they are looking same no change observed. I'm working on "Multiple Password Reset" alert from a long time. But today I tried to write a new rule then i observed the initiatedby field is not showing the iPaddress.
James Hamil 27,211 Reputation points Microsoft Employee Moderator

2021-01-19T23:55:14.547+00:00

Hi, I'm looking into this with our escalations group. I'll let you know what I find!

Best,
James

Answer 1

Hi @Ashok , the audit logs in Azure AD will not show you the IP address. If you see the columns in audit logs, you will find that the IP Address property is not included. Ref -> https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/auditlogs#columns and https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-audit-logs

IP Address is included as a property in the columns of sign-in logs in Azure AD. Ref -> https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-sign-ins

So to get IP Address of the user whenever there is a password reset activity, you can correlate between the audit logs and the sign in logs. Please ref the correlation id from the audit logs for the SSPR activity and filter it in the sign in logs, from where you could get the IP address of the user.
Alternatively, you can match the Object Id in the Audit logs which should be the user id in the sign in logs along with the timestamp.

Audit Log :

Sign in Log:

Ashok 1 Reputation point

2021-01-21T23:03:50.553+00:00

Will this works for a very stranger who is for example an attacker who did not signed in yet but trying to attempt reset.

Share via

IPaddress showing null value for User submitted their user ID step in passwordreset activity.

1 answer

Your answer