Microsoft Sentinel
A scalable, cloud-native solution for security information event management and security orchestration automated response. Previously known as Azure Sentinel.
1,061 questions
Regarding None Accounts Adding to Security Enabled Local, Global and Universal Groups
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 83%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESP%3C/text%3E%3C/svg%3E)
Srisaiteja Palle
20
Reputation points
Hello Team,
Greetings!!
During our monitoring activities in Sentinel, we have observed that some non-accounts have been added to security-enabled local, global, and universal groups.
Could you please provide insight into why this activity is being performed?
Thank you for your attention to this matter.
Thanks & Regards,
Sri Sai Teja Palle.
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(44.800000000000004, 78%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESG%3C/text%3E%3C/svg%3E)
Sandeep G-MSFT 16,691 Reputation points Microsoft Employee2024-07-04T04:27:36.5666667+00:00 Thank you for posting this in Microsoft Q&A.
As I understand you are seeing that some accounts are added to different groups.
Can you let us know what kind of accounts are those? Ex. Guest accounts, unlicensed accounts, service principals etc.
Did you check the audit logs in Entra ID to confirm why these accounts were added to these groups?
-
Srisaiteja Palle 20 Reputation points
2024-07-05T15:57:06.93+00:00 Hello @Sandeep G-MSFT ,
Greetings!!
Thanks for the response.
I would like to update you that Accounts with no Member Name in target account it is Showing as "SystemAccount/None" (eg. "test$/None" for test Machine) is been added or removed in Security Enabled Global, Local & Universal Group
To Conclude I can Confirm that Accounts with Name "None" is been added and removed from Security Enabled Local, Global and Universal Group No Idea why is this activity Performed I would like to Undersatnd What it is?
Thanks & Regards,
Sri Sai Teja Palle.
Sign in to comment