Creating an alert for blocked logIn account in Azure AD

Ashutosh Joshi 1 Reputation point
2021-09-18T13:59:07.03+00:00

Hello Team,

I wanted to get create alert for blocked login account in Azure AD from signIn logs but not to find the required query. If I find it, than the alerts throws the errors if I configure myself saying not a valid query. Can you please provide the required query or point in to a direction where I can find it. Looking forward to hearing from you,

Thanks !!!

Azure Active Directory
Azure Active Directory
An Azure enterprise identity service that provides single sign-on and multi-factor authentication.
14,910 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Devaraj G 2,176 Reputation points
    2021-09-19T10:31:39.13+00:00

    Hi Ashutosh,

    For more granular hunting queries for Azure AD logs, I would recommend to leverage azure Sentinal which is SIEM and SOAR tool offered by Azure Microsoft. this can give you lots of inbuilt capabilities on security monitoring for azure sign-ins along with many other integration.

    with respect to blocked sing-in , let me also try the custom query in my lab and update you.

    0 comments