Monitor Azure CSP logins

Question

Hi,

Is there any way to monitor if a Partner logins to our Azure Tenant using there CSP Partner login?

Answer 1

Hi @Torben Andersen ,

Yes, you can monitor Partner logins to your Azure Tenant using their CSP Partner login. Partners with an Azure Active Directory P2 license automatically qualify to keep audit and sign-in log data up to 30 days.

You can confirm that audit logging is in place where delegated administrator accounts are used and that logs are capturing the maximum level of details provided by the service. Logs should be retained for an acceptable period (up to 30 days) that allows for detection of anomalous activity.

Additionally, you can review and audit Azure AD sign-ins and configuration changes using the Azure AD sign-in logs, Azure AD audit logs, and the Microsoft Purview compliance portal. You can see a filtered view of partner sign-ins by going to the sign-in logs in the Azure AD admin portal and adding the filter Cross-tenant access type: Service provider on the User-sign ins (non-interactive) tab.

References:

• CSP security best practices - Monitoring best practices
• Azure AD audit activity reference
• Customer security best practices
• Analyze Azure AD activity logs with Log Analytics

Just FYI, this response is partially based on Q&A AI Assist and posted after manually validating the accuracy of the response and making necessary changes as appropriate.