Emergency Break Glass sign-in using storage account rathr than Log Analytics workspace

Question

Emergency Break Glass sign-in using storage account rathr than Log Analytics workspace

AnnaG 166

would like to put break glass emergency accounts in place in Azure. Everything I look at uses Log Analytics or Sentinel.
Our customer already send logs for audit and sign-ins to a storage account. For this reason I want to sent the logs to a Log Analytics Workspace as well
but I do not think this can be avoided right? I need to generate a query and this requires Log Analytics but doesn't it mean more costs because I have the same logs in two different locations? Good for Microsoft, not so good for the customer?

Can you please let me know if this is correct? If I need to also send to another Log Analytics Workspace and have no choice, I will set this up. Just wanted to make 100% sure there was no other way.

AnnaG 166 Reputation points

2022-07-31T16:51:19.65+00:00

Actually I read in the portal you dont pay for 31 days which should be enough. Can anyone please confirm? This was the only reason I was reluctant to create another Log Analytics Workspace. I guess this applies to each workspace created?

1 answer

Your answer

AnnaG 166 Reputation points

2022-07-31T16:51:19.65+00:00

Actually I read in the portal you dont pay for 31 days which should be enough. Can anyone please confirm? This was the only reason I was reluctant to create another Log Analytics Workspace. I guess this applies to each workspace created?

Answer 1

Andrew Blumhardt 10,066 Microsoft Employee

I am not clear on the association between a break glass account and Log Analytics? You can use logs to monitor and alert on account usage. https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

Azure Monitor workspaces (log analytics) are billed based on the volume of data ingested. This includes 31 days of retention. Most diagnostic logs are fairly inexpensive to collect. It really depends on the volume of data. These logs are readily accessible and are fairly easy to add alerts if needed. https://azure.microsoft.com/en-in/pricing/details/monitor

Azure Activity logs are free n Log Analytics, AAD audit logs are not.

AnnaG 166 Reputation points

2022-07-31T17:32:47.777+00:00

I should have been clearer. My query relates to alerts.

https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access#monitor-sign-in-and-audit-logs
The alert side point to the log Analytics workspace. Sentinel can also be used but that's expensive.
Andrew Blumhardt 10,066 Reputation points Microsoft Employee

2022-07-31T17:45:30.717+00:00

Right. So the solution that you referenced provides sample Azure Monitor alerts. Similar alerts can be created in Sentinel. There is a cost for both (based on per GB daily ingestion). Easy to turn back off if you don't like the price. Sentinel costs more but it also provides more benefits including behavioral analytics, better alert management, and built-in alert templates. Sentinel also includes 90 days of retention. You might also be able to send the audit data to an alternative service like Splunk or query the API directly.
AnnaG 166 Reputation points

2022-07-31T19:16:36.137+00:00

Yes I am aware of Sentinel.
Customer is already using storage account for logs and not sending to log analytics which is why I was trying to avoid sending to log analytics as well. That would just be duplicating files which is pointless to get alerts set for this sort of thing. The important thing then is the default of 30 day retention for log analytics comes at no extra cost to the customer right? If this is this is the case I will set this up per MS example.
AnnaG 166 Reputation points

2022-07-31T19:28:04.273+00:00

Ignore. All sorted
Monalla-MSFT 13,161 Reputation points Moderator

2022-08-04T13:29:57.063+00:00

@AnnaG - Glad that the issue is resolved for you. If this answers your query, do click "Accept as Answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
AnnaG 166 Reputation points

2023-04-05T23:27:48.0133333+00:00

It states Log Analytics query is required. Alll sorted as I ended up creating one.

Share via

Emergency Break Glass sign-in using storage account rathr than Log Analytics workspace

1 answer

Your answer