MFA Monitor Alerts

Laxson Paradza 20 Reputation points
2023-11-24T08:00:16.68+00:00

Hi

I am trying to create Alerts whenever someone signs in without MFA, I have been looking at Azure Monitor Alerts and i can see some Alerts for other resources but not for EntraID, i am wondering if anyone has done this in any other way.

Thank you

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,014 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,535 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Clive Watson 5,951 Reputation points MVP
    2023-11-24T10:30:45.57+00:00

    Hello, Microsoft Sentinel has a connector for Entra - this allows the right data to be collected and Rules to detect many sign in scenarios, like MFA to be run. https://learn.microsoft.com/en-us/azure/sentinel/connect-azure-active-directory
    However whilst this uses Azure Monitor there are costs associated. If you just kept it to SigninLogs the costs are typically fairly minimal, and you get a free trial if that helps? https://learn.microsoft.com/en-us/azure/sentinel/billing?tabs=simplified%2Ccommitment-tiers#free-trial

    0 comments No comments