Creating an alert for blocked logIn account in Azure AD

Question

Hello Team,

I wanted to get create alert for blocked login account in Azure AD from signIn logs but not to find the required query. If I find it, than the alerts throws the errors if I configure myself saying not a valid query. Can you please provide the required query or point in to a direction where I can find it. Looking forward to hearing from you,

Thanks !!!

Answer 1

Hi Ashutosh,

For more granular hunting queries for Azure AD logs, I would recommend to leverage azure Sentinal which is SIEM and SOAR tool offered by Azure Microsoft. this can give you lots of inbuilt capabilities on security monitoring for azure sign-ins along with many other integration.

with respect to blocked sing-in , let me also try the custom query in my lab and update you.

Answer 2

Am currently researching this too as a user was blocked yesterday and we had no notification of it. Simply telling a user to purchase AZ sentinel is not an acceptable answer to the question, and no further info is provided...