Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
22,543 questions
Help with log interpretation - Azure AD
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(115.19999999999999, 96%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERA%3C/text%3E%3C/svg%3E)
Rodrigo Apablaza
5
Reputation points
Hi Guys, we have a log in Azure with the following :
Service : PIM
Category: ResourceManagement
Activity : Onboarded resource to PIM
Status : Success
Destination : /
Modified Property
DisplayKey = 0
OriginId = "/"
Status = "Active"
The account do no have admin role only as a user, but was connect from another country.
The log entry was unique.
Thank you !!!
{count} votes
-
Dillon Silzer 57,471 Reputation points2023-05-01T02:40:59.92+00:00 Can you please give us some more detail on what the problem is? It looks like the account was granted privileges with PIM. Was it not supposed to get privileges? What seems to be the error/issue?
-
Rodrigo Apablaza 5 Reputation points
2023-05-01T12:07:19.8233333+00:00 hi Dillon, the log entry appeared after a successful login from another country. We checked PIM and the account has no privileges at all, it is a common user. We reviewed logs of other activities from that IP and nothing was recorded either. Then we change the user's password.
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 95%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHJ%3C/text%3E%3C/svg%3E)
Hussein Josef Bilfeldt 0 Reputation points2023-05-13T18:45:38.4066667+00:00 Has this matter been resolved yet? I have a similiar incident.
Sign in to comment
Sign in to answer