Understanding Risky Signs in Azure Active Directory

Azure Active Directory (AAD) Identity Protection (IPC) is a powerful tool that helps organizations detect and remediate identity-based risks in their environment. One of the essential features of IPC is risk detection, which enables administrators to identify potential security threats and take prompt action to prevent them from causing harm.

In this article, we will explore the concept of risky signs in Azure AD and discuss how you can use the Microsoft Graph API to query information about user and sign-in linked risk detections.

What are Risky Signs in Azure AD?

Risky signs refer to unusual or suspicious activities that may indicate a security threat. These signs can include things like multiple failed login attempts, login from an unfamiliar location, or use of a weak password. When a risky sign is detected, IPC generates an event that alerts administrators to the potential issue.

Querying Risky Signs using Microsoft Graph API

To query information about user and sign-in linked risk detections, you can use the `identityRiskEvent` API, which provides detailed information about each detection. This API allows you to retrieve descriptions of each risk detection, along with other relevant details such as the timestamp and IP address associated with the event.

In addition to the `identityRiskEvent` API, you can also use the Azure AD IPC Reporting & Monitoring Capabilities to gather insights into your organization's identity-based risks. These capabilities provide real-time reporting and monitoring of identity-related events, enabling administrators to quickly identify and respond to potential security threats.

Sending Risky Signs to 3rd Party SIEM

One common question from the community is how to send Azure AD Identity Protection (IPC) events to 3rd party Security Information and Event Management (SIEM) systems. While deploying data connectors between native Microsoft products can be straightforward, sending security events/alerts from the cloud to a third-party SIEM can be more challenging.

In many environments where I work, organizations have deployed Microsoft security solutions, including Azure Sentinel, in addition to their existing SIEM systems. To integrate these solutions and send risky signs from Azure AD to 3rd party SIEM, administrators need to configure data connectors and workflows that enable seamless communication between the two systems.

In this article, we have explored the concept of risky signs in Azure Active Directory and discussed how you can use the Microsoft Graph API to query information about user and sign-in linked risk detections. We also touched on the importance of sending these events to 3rd party SIEM systems for comprehensive security monitoring and incident response.

By understanding the risks associated with identity-based threats and configuring data connectors to send those events to your organization's SIEM system, you can enhance your overall security posture and protect against potential attacks.

Risky sign in azure ad