Azure AD - Activity Details Test

Azure Active Directory provides Audit Logs, where changes/updates to the configuration of users, groups, and applications are logged. With the audit logs in Azure AD, administrators get access to records of system activities for compliance.

Whenever critical changes are made to an Azure organization - e.g., a password is changed, an application is updated, if the license of a user has changed etc. - administrators may want to know whether such changes were initiated by authorized services/users. This is because, unauthorized changes, if permitted, can have serious, long-standing repurcussions on the overall health and operations of the cloud organization. To quickly spot such changes, and to know what was changed and by whom, administrators need to review the audit logs periodically. The Azure AD - Activity Details test helps administrators in this exercise! 

This test monitors the Azure AD audit logs at configured intervals, and notifies administrators every time a user-, group-, or application-related change/activity is logged in the audit log file.

Detailed diagnostics provide additional details about the change/activity, thereby enabling administrators to figure out who made the change and when. With the help of this information, administrators can quickly detect unauthorized changes, and take appropriate action.

Target of the Test: A Microsoft Azure Active Directory

Agent deploying the test: A remote agent

Output of the test: One set of results for the Azure AD tenant being monitored

Configurable parameters for the test
Parameters Description

Test Period

How often should the test be executed.

Host

The host for which the test is to be configured.

Tenant ID

Specify the Directory ID of the Azure AD tenant to which the target subscription belongs. To know how to determine the Directory ID, refer to Configuring the eG Agent to Monitor Microsoft Azure Active Directory Using Microsoft Graph API

Client ID, Client Password, and Confirm Password

To connect to Azure AD, the eG agent requires an Access token in the form of an Application ID and the client secret value. If a Microsoft Azure Subscription component is already monitored in your environment, then you would have already created an Application for monitoring purposes. You can provide the Application ID and Client Secret value of that application here. However, if no such application pre-exists, you will have to create one for monitoring Azure AD. To know how to create such an application and determine its Application ID and Client Secret, refer to Configuring the eG Agent to Monitor Microsoft Azure Active Directory Using Microsoft Graph API. Specify the Application ID of the Application in the Client ID text box and the client secret value in the Client Password text box. Confirm the Client Password by retyping it in the Confirm Password text box.

Proxy Host

In some environments, all communication with the Azure cloud be routed through a proxy server. In such environments, you should make sure that the eG agent connects to the cloud via the proxy server and collects metrics. To enable metrics collection via a proxy, specify the IP address of the proxy server and the port at which the server listens against the Proxy Host and Proxy Port parameters. By default, these parameters are set to none, indicating that the eG agent is not configured to communicate via a proxy, by default.

Proxy Username, Proxy Password and Confirm Password

If the proxy server requires authentication, then, specify a valid proxy user name and password in the Proxy Username and Proxy Password parameters, respectively. Then, confirm the password by retyping it in the Confirm Password text box.

Detailed Diagnosis

To make diagnosis more efficient and accurate, the eG Enterprise embeds an optional detailed diagnostic capability. With this capability, the eG agents can be configured to run detailed, more elaborate tests as and when specific problems are detected. To enable the detailed diagnosis capability of this test for a particular server, choose the On option. To disable the capability, click on the Off option.

The option to selectively enable/disable the detailed diagnosis capability will be available only if the following conditions are fulfilled:

  • The eG manager license should allow the detailed diagnosis capability
  • Both the normal and abnormal frequencies configured for the detailed diagnosis measures should not be 0.

Measures made by the test:
Measurement Description Measurement Unit Interpretation

Add user

Indicates the number of 'add user' activities performed on Azure AD.

Number

Use the detailed diagnosis of this measure to know when the addition occurred, who initiated the addition, the status of the attempt (success/failure), and the reason for the failure (if any).

Delete user

Indicates the number of 'delete user' actions that were performed on Azure AD.

Number

Use the detailed diagnosis of this measure to know when the deletionion occurred, who initiated the deletion, the status of the attempt (success/failure), and the reason for the failure (if any).

Update user

Indicates the number of 'update user' actions that were performed on Azure AD.

Number

Use the detailed diagnosis of this measure to know when the updation occurred, who initiated it, the status of the updation attempt (success/failure), and the reason for the failure (if any).

Restore user

Indicates the number of 'restore user' actions that were performed on Azure AD.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Disable user account

Indicates the number of 'disable user account' actions that were performed on Azure AD.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Change user license

Indicates the number of 'change user license' actions that were performed on Azure AD.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Change user password

Indicates the number of attempts made to change user passwords.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Reset user password

Indicates the number of attempts made to reset user passwords.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Set force change user password

Indicates the number of attempts made to force-change user passwords.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

User password registration

Indicates the number of attempts made to register user passwords.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Enable strong authentication

Indicates the number of attempts made to enable strong authentication.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Create application password for user

Indicates the number of attempts made to create an application password for users.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Delete application password for user

Indicates the number of attempts made to delete an application password for users.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Admin generates a temporary password

Indicates the number of attempts made by an admin to generate a temporary password.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add application

Indicates the number of 'add application' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Delete application

Indicates the number of 'delete application' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update application

Indicates the number of 'update application' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Restore application

Indicates the number of restore application' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add service principal

Indicates the number of attempts made to add service principals.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add service principal credentials

Indicates the number of attempts made to add service principal credentials.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update service principal

Indicates the number of attempts made to update service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove service principal

Indicates the number of attempts made to remove service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove service principal credentials

Indicates the number of attempts made to remove service principal credentials.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add group

Indicates the number of attempts made to add groups.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Create group settings

Indicates the number of attempts made to create group settings.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Delete group

Indicates the number of 'delete application' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Delete group settings

Indicates the number of attempts made to delete group settings.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update group

Indicates the number of 'update group' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update group settings

Indicates the number of attempts made to update group settings.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Restore group

Indicates the number of 'restore group' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Start applying group-based license to users

Indicates the number of times the application of group-based licenses to users were started.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Finish applying group-based license to users

Indicates the number of times the application of group-based licenses to users were completed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Set group license

Indicates the number of attempts made to set group licenses.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Trigger group license recalculation

Indicates the number of attempts made to trigger group license recalculation.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add policy

Indicates the number of 'add policy' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add policy to application

Indicates the number of attempts made to add policy to application.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add policy to service principal

Indicates the number of attempts made to add policy to service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Delete policy

Indicates the number of 'delete policy' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update policy

Indicates the number of 'update policy' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add role definition

Indicates the number of attempts made to add role definitions.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add role assignment to role definition

Indicates the number of attempts made to add role assignment to role definitions.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add eligible member to role

Indicates the number of attempts made to add eligible member to role.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add role from template

Indicates the number of attempts made to add role from template.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Delete role definition

Indicates the number of attempts made to delete role definitions.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove eligible member from role

Indicates the number of attempts made to remove eligible member from role.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove role assignment from role definition

Indicates the number of attempts made to remove role assignment from role definition.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove scoped member from role

Indicates the number of attempts made to remove scoped member from role.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update role

Indicates the number of 'update role' actions that were performed.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Update role definition

Indicates the number of attempts made to update role definitions.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add owner to policy

Indicates the number of attempts made to add owner to policy.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add owner to application

Indicates the number of attempts made to add owner to application.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add owner to group

Indicates the number of attempts made to add owner to group.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add owner to service principal

Indicates the number of attempts made to add owner to service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove owner from group

Indicates the number of attempts made to remove owner from group.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove owner from policy

Indicates the number of attempts made to remove owner from policy.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove owner from application

Indicates the number of attempts made to remove owner from application.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove owner from service principal

Indicates the number of attempts made to remove owner from service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove member from group

Indicates the number of attempts made to remove member from group.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove member from role

Indicates the number of attempts made to remove member from role.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove member from administrative unit

Indicates the number of attempts made to remove member from administrative unit.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add member to role

Indicates the number of attempts made to remove member from administrative unit.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add member to group

Indicates the number of attempts made to add member to group.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add member to administrative unit

Indicates the number of attempts made to add member to administrative unit.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add app role assignment to service principal

Indicates the number of attempts made to add app role assignment to service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add app role assignment to user

Indicates the number of attempts made to add app role assignment to user.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Add app role assignment to group

Indicates the number of attempts made to add app role assignment to group.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove app role assignment from service principal

Indicates the number of attempts made to remove app role assignment from service principal.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove app role assignment from user

Indicates the number of attempts made to remove app role assignment from user.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Remove app role assignment from group

Indicates the number of attempts made to remove app role assignment from group.

Number

Use the detailed diagnosis of this measure to know when the action occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Use the detailed diagnosis of the Add application, Update application, and Delete application measures to know when each of the corresponding actions (i.e., 'add application', 'update application', or 'delete application' action) occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Figure 1 : The detailed diagnosis of the Add application measure

Figure 2 : The detailed diagnosis of the Delete application measure

Figure 3 : The detailed diagnosis of the Update application measure

Use the detailed diagnosis of the Add service principal, Update service principal, and Remove service principal measures to know when each of the corresponding actions (i.e., 'add service principal', 'update service principal', or 'delete service principal' action) occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Figure 4 : The detailed diagnosis of the Add service principal measure

Figure 5 : The detailed diagnosis of the Update service principal measure

Figure 6 : The detailed diagnosis of the Remove service principal measure

Use the detailed diagnosis of the Add owner to application, Add owner to service principal, and Remove member from group measures to know when each of the corresponding actions occurred, who initiated it, the status of the action (success/failure), and the reason for the failure (if any).

Figure 7 : The detailed diagnosis of the Add owner to application measure

Figure 8 : The detailed diagnosis of the Add owner to service principal measure

Figure 9 : The detailed diagnosis of the Remove member from group measure