How do we monitor activity and changes to a specific service account in Azure with email alerts

Question

what are specific steps for monitoring a service account (or multiple accounts by group) for all activity and changes to the account permissions, etc. - email or other immediate alerting would be required. I would like to be able to filter out approved activity if possible. This is in a GCC environment.

Example: backup and restore tool service account with access to teams and sharepoint data doing anything other than backups.

Answer 1

Hi Bruce.

Monitoring activity and changes to a specific service account in Azure with email alerts can be achieved using Azure Monitor Alerts

You can create an alert following this documentation https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-manage-alert-rules?wt.mc_id=studentamb_232547

Hope this helps!

Remember to accept the answer if it is helpful.

Answer 2

Entra "Permissions Management" feature appears to be able to possibly do what we need, but as the trial has already been used I will need to have someone approve purchase for at least one "resource" in order to confirm this.

Monitor Alerts do not appear to be able to allow monitoring of Entra accounts from what I can see in our environment. If this is possible could someone provide DETAILS on how to configure?