Azure Monitor alerts sent to SIEM

Question

I recently created an alert rule on our Azure Monitor to fire an alert when a Conditional Access policy is modified, updated, created or deleted.

The alerts get fired correctly on Azure Monitor under the Alerts section. however i need to get these alerts through to our SIEM tool.

I couldn't find information on that, i only found info on how to pass Defender for Cloud alerts to the SIEM.

Answer 1

If your SIEM is Microsoft Sentinel, then this blog article:

Monitor Conditional Access with Microsoft Sentinel

And Analytics rules could be key.

If your SIEM is not Sentinel, then your SIEM may have specific data packs or connectors to enable this functionality by collecting the conditional access changes from the Azure activity log, and alerting off that.