How detecting the failed login attempts to a Synapse Analytics serverless SQL pool

pmscorca 987

Hi,

I need to know how detecting and analyzing the failed login attempts to a Synapse serverless SQL pool.

Does it exist a step-by-step procedure to follow in order to accomplish a such task, please? Thanks

Smaran Thoomu 14,870 Reputation points Microsoft Vendor

2024-09-06T14:23:58.0966667+00:00

@pmscorca Following up to see if the below answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

1 answer

Smaran Thoomu 14,870 Reputation points Microsoft Vendor

2024-09-05T21:15:20.4766667+00:00
Hi @pmscorca

Thanks for the question and using MS Q&A platform.

Detecting and analyzing failed login attempts to a Synapse Analytics serverless SQL pool is important for security and auditing. From what I know, you can use Azure Monitor to track login attempts, but it may not provide in-depth analysis. If you need more detailed insights, this might not be enough. Here are the steps to follow:

In the Azure portal, navigate to your Synapse workspace.

In the left-hand menu, click on "Monitoring".

Click on "Metrics" and select the "Built-in SQL pool" resource type.

Select the "BuiltinSqlPoolLoginAttempts" metric.

Choose the time range for which you want to view the data.

You can filter the data by selecting the "Result" dimension and choosing "Failed".

You can also group the data by selecting the "Client IP" dimension to see which IP addresses are attempting to log in.

For more information you can refer this official doc: Azure Synapse Analytics monitoring data reference

Hope this helps. Do let us know if you any further queries.

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Please sign in to rate this answer.
pmscorca 987 Reputation points

2024-09-06T14:37:21.17+00:00

Hi, thanks for your reply.

using metrics I can obtain an aggregation metric about the failed login attempts and not which are these attempts. I don't know how grouping the data by a Client IP.

I'd like to understand the reason for a specific failed login attempt.

Could it be more useful a system view such as sys.dm_exec_connections or sys.dm_exec_sessions?

pmscorca 987 Reputation points

2024-09-06T14:41:49.79+00:00

Hi, I've added a comment but it doesn't visible yet.

Smaran Thoomu 14,870 Reputation points Microsoft Vendor

2024-09-09T21:58:54.15+00:00

@pmscorca Thank you for your response. I understand that you would like to know the reason for a specific failed login attempt to a Synapse Analytics serverless SQL pool. While metrics can provide an aggregation of failed login attempts, it may not provide detailed information about each attempt.

You can use system views such as sys.dm_exec_connections or sys.dm_exec_sessions to get more detailed information about failed login attempts. These views can provide information such as the login name, client IP address, and error message associated with each login attempt.

Please refer this doc for more information: https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins

I hope this helps. Please let me know if you have any questions.

Smaran Thoomu 14,870 Reputation points Microsoft Vendor

2024-09-10T21:12:13.2433333+00:00

@pmscorca Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How detecting the failed login attempts to a Synapse Analytics serverless SQL pool

1 answer

Your answer