Azure AD external Users

Question

Azure AD external Users

Mohamed jihad bayali 1,141

Hello dear team,

I have a question on Azure AD,

I just started working with a client, and one of my tasks is to stop the users from an external domain to access my client's tenant.

I first thinked to disable the Guest users accounts created from b2b, but the weird thing is that i cannot see those external users appearing on azure AD as guest users,member users..., and i can not see them on the signin logs also , but i see some events initiated by them on the activity logs on some virtual machines. (The events are initiated by their personal email address)

I was thinking if these users are accessing the tenant with a different way (except from b2b), any idea where i can look?

Other thing, if i restrict their domain from Azure AD external users, they won't be able to access the portal right?

Thanks

Anonymous

2022-10-10T22:29:39.32+00:00

Hi @Mohamed jihad bayali , can you please post some screenshots of what you're seeing? For both the activity logs on your VM and any others you can share. Also, what events were initiated? RDP, Start/Stop/Restart, etc.? The collaboration settings that you're referring to is for Azure AD, not VMs. You could also check to see if you're logging in the VMs and not Azure.

Please let me know and I can help you further.

Thank you,
James
Mohamed jihad bayali 1,141 Reputation points

2022-10-11T08:16:54.827+00:00

Hello James,

Here is some events that were initiated recently by those external users

Remove VM extensions :

Remove runbooks from Automation accounts :

If my understanding is correct, for a user to do such actions, he need to sign in to the portal, and essentially he need to have an account on the tenant (Guest or member account)
Weird thing is that when i'm checking on the AD users, i cannot find the account who did these actions, and if i look on the sign in logs, and filter by his email, username, or IP address, i cannot find him.
On the screenshots that i sent you, those events where initiated by the external user with his external email ******@PersonalDomain.com, not ******@mydomain.com. this is why i thinked about Azure B2B in the first place.

What do you think?

Your answer

Anonymous

2022-10-10T22:29:39.32+00:00

Hi @Mohamed jihad bayali , can you please post some screenshots of what you're seeing? For both the activity logs on your VM and any others you can share. Also, what events were initiated? RDP, Start/Stop/Restart, etc.? The collaboration settings that you're referring to is for Azure AD, not VMs. You could also check to see if you're logging in the VMs and not Azure.

Please let me know and I can help you further.

Thank you,
James
Mohamed jihad bayali 1,141 Reputation points

2022-10-11T08:16:54.827+00:00

Hello James,

Here is some events that were initiated recently by those external users

Remove VM extensions :

Remove runbooks from Automation accounts :

If my understanding is correct, for a user to do such actions, he need to sign in to the portal, and essentially he need to have an account on the tenant (Guest or member account)
Weird thing is that when i'm checking on the AD users, i cannot find the account who did these actions, and if i look on the sign in logs, and filter by his email, username, or IP address, i cannot find him.
On the screenshots that i sent you, those events where initiated by the external user with his external email ******@PersonalDomain.com, not ******@mydomain.com. this is why i thinked about Azure B2B in the first place.

What do you think?

Share via

Azure AD external Users

Your answer