Failed Login Alert for Azure Application

JMWee 6

Hello,

I am thinking of a best way to be alerted for some sign in attempt criteria for my Azure AD which includes the Enterprise Application where we are using Azure AD as SSO to login to other system like Atlassian, Office.com, AWS, etc.

I started shipping the logs from Azure AD to Azure Log Analytics Workspace, but having problem in specifying the correct query for me to create an alert. I am after with the below trigger.

10 Failed Login attempts in period of 10secs.
20 Consecutive failed logins attempts.
Login form the hostile country like Russia, North Korea, etc.

Anyone can able to assist me with the right approach I need to do on this?

Carlos Solís Salazar 17,791 Reputation points MVP

2022-07-12T15:21:57.723+00:00

Thank you for asking this question on the **Microsoft Q&A Platform. **

You have not received answers or comments to your question because it may be ambiguous or confusing.

I recommend you visit How to write a quality question and verify that your question meets some of the recommendations.

Hope this helps,
Carlos Solís Salazar

----------

NOTE: To answer you as quickly as possible, please mention me in your reply.
Joao Pereira 0 Reputation points

2024-01-18T10:39:43.86+00:00

Hi JMWee - just checking if you got any results on login alerts up on Azure application failed sign-in ?
Thanks

Share via

Failed Login Alert for Azure Application