You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/conditional-access/concept-condition-filters-for-devices.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Use filter for devices in Conditional Access to enhance security po
4
4
ms.service: active-directory
5
5
ms.subservice: conditional-access
6
6
ms.topic: conceptual
7
-
ms.date: 04/28/2022
7
+
ms.date: 01/25/2023
8
8
ms.author: joflore
9
9
author: MicrosoftGuyJFlo
10
10
manager: amycolannino
@@ -19,7 +19,7 @@ When creating Conditional Access policies, administrators have asked for the abi
19
19
20
20
## Common scenarios
21
21
22
-
There are multiple scenarios that organizations can now enable using filter for devices condition. Below are some core scenarios with examples of how to use this new condition.
22
+
There are multiple scenarios that organizations can now enable using filter for devices condition. The following scenarios provide examples of how to use this new condition.
23
23
24
24
-**Restrict access to privileged resources**. For this example, lets say you want to allow access to Microsoft Azure Management from a user who is assigned a privileged role Global Admin, has satisfied multifactor authentication and accessing from a device that is [privileged or secure admin workstations](/security/compass/privileged-access-devices) and attested as compliant. For this scenario, organizations would create two Conditional Access policies:
25
25
- Policy 1: All users with the directory role of Global Administrator, accessing the Microsoft Azure Management cloud app, and for Access controls, Grant access, but require multifactor authentication and require device to be marked as compliant.
@@ -89,7 +89,7 @@ Setting extension attributes is made possible through the Graph API. For more in
89
89
90
90
### Filter for devices Graph API
91
91
92
-
The filter for devices API is available in Microsoft Graph v1.0 endpoint and can be accessed using https://graph.microsoft.com/v1.0/identity/conditionalaccess/policies/. You can configure a filter for devices when creating a new Conditional Access policy or you can update an existing policy to configure the filter for devices condition. To update an existing policy, you can do a patch call on the Microsoft Graph v1.0 endpoint mentioned above by appending the policy ID of an existing policy and executing the following request body. The example here shows configuring a filter for devices condition excluding devices that aren't marked as SAW devices. The rule syntax can consist of more than one single expression. To learn more about the syntax, see [dynamic membership rules for groups in Azure Active Directory](../enterprise-users/groups-dynamic-membership.md).
92
+
The filter for devices API is available in Microsoft Graph v1.0 endpoint and can be accessed using the endpoint `https://graph.microsoft.com/v1.0/identity/conditionalaccess/policies/`. You can configure a filter for devices when creating a new Conditional Access policy or you can update an existing policy to configure the filter for devices condition. To update an existing policy, you can do a patch call on the Microsoft Graph v1.0 endpoint by appending the policy ID of an existing policy and executing the following request body. The example here shows configuring a filter for devices condition excluding devices that aren't marked as SAW devices. The rule syntax can consist of more than one single expression. To learn more about the syntax, see [dynamic membership rules for groups in Azure Active Directory](../enterprise-users/groups-dynamic-membership.md).
93
93
94
94
```json
95
95
{
@@ -136,7 +136,7 @@ The following device attributes can be used with the filter for devices conditio
136
136
137
137
## Policy behavior with filter for devices
138
138
139
-
The filter for devices condition in Conditional Access evaluates policy based on device attributes of a registered device in Azure AD and hence it's important to understand under what circumstances the policy is applied or not applied. The table below illustrates the behavior when a filter for devices condition is configured.
139
+
The filter for devices condition in Conditional Access evaluates policy based on device attributes of a registered device in Azure AD and hence it's important to understand under what circumstances the policy is applied or not applied. The following table illustrates the behavior when a filter for devices condition is configured.
140
140
141
141
| Filter for devices condition | Device registration state | Device filter Applied
Copy file name to clipboardExpand all lines: articles/azure-monitor/agents/agents-overview.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Overview of the Azure Monitor Agent, which collects monitoring data
4
4
ms.topic: conceptual
5
5
author: guywi-ms
6
6
ms.author: guywild
7
-
ms.date: 1/23/2023
7
+
ms.date: 1/24/2023
8
8
ms.custom: references_regions
9
9
ms.reviewer: shseth
10
10
@@ -82,6 +82,8 @@ In addition to the generally available data collection listed above, Azure Monit
82
82
|[Change Tracking](../../automation/change-tracking/overview.md)| Public preview | Change Tracking extension |[Change Tracking and Inventory using Azure Monitor Agent](../../automation/change-tracking/overview-monitoring-agent.md)|
83
83
|[Update Management](../../automation/update-management/overview.md) (available without Azure Monitor Agent) | Use Update Management v2 - Public preview | None |[Update management center (Public preview) documentation](../../update-center/index.yml)|
84
84
|[Network Watcher](../../network-watcher/network-watcher-monitoring-overview.md)| Connection Monitor: Public preview | Azure NetworkWatcher extension |[Monitor network connectivity by using Azure Monitor Agent](../../network-watcher/azure-monitor-agent-with-connection-monitor.md)|
85
+
|[SQL Best Practices Assessment](/sql/sql-server/azure-arc/assess/)| Generally available ||[Configure best practices assessment using Azure Monitor Agent](/sql/sql-server/azure-arc/assess#enable-best-practices-assessment)|
86
+
85
87
86
88
## Supported regions
87
89
@@ -124,6 +126,7 @@ The tables below provide a comparison of Azure Monitor Agent with the legacy the
124
126
|| Microsoft Defender for Cloud | X (Public preview) | X ||
125
127
|| Update Management | X (Public preview, independent of monitoring agents) | X ||
Today, the following diagnostic log categories are available for Azure Firewall:
63
-
- Application rule log
64
-
- Network rule log
65
-
- DNS proxy log
62
+
With Structured Firewall Logs, you'll be able to choose to use Resource Specific tables instead of an existing AzureDiagnostics table. Structured Firewall Logs is required for Policy Analytics. This new method helps you with better log querying and is recommended because:
66
63
67
-
These log categories use [Azure diagnostics mode](../azure-monitor/essentials/resource-logs.md#azure-diagnostics-mode). In this mode, all data from any diagnostic setting will be collected in the [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table.
64
+
- It's easier to work with the data in the log queries
65
+
- It's easier to discover schemas and their structure
66
+
- It improves performance across both ingestion latency and query times
67
+
- It allows you to grant Azure RBAC rights on a specific table
68
68
69
-
With this new feature, you'll be able to choose to use [Resource Specific Tables](../azure-monitor/essentials/resource-logs.md#resource-specific) instead of the existing [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table. In case both sets of logs are required, at least two diagnostic settings need to be created per firewall.
70
-
71
-
In **Resource specific** mode, individual tables in the selected workspace are created for each category selected in the diagnostic setting. This method is recommended since it:
72
-
- makes it much easier to work with the data in log queries
73
-
- makes it easier to discover schemas and their structure
74
-
- improves performance across both ingestion latency and query times
75
-
- allows you to grant Azure RBAC rights on a specific table
76
-
77
-
New resource specific tables are now available in Diagnostic setting that allows you to utilize the following newly added categories:
78
-
79
-
-[Network rule log](/azure/azure-monitor/reference/tables/azfwnetworkrule) - Contains all Network Rule log data. Each match between data plane and network rule creates a log entry with the data plane packet and the matched rule's attributes.
80
-
-[NAT rule log](/azure/azure-monitor/reference/tables/azfwnatrule) - Contains all DNAT (Destination Network Address Translation) events log data. Each match between data plane and DNAT rule creates a log entry with the data plane packet and the matched rule's attributes.
81
-
-[Application rule log](/azure/azure-monitor/reference/tables/azfwapplicationrule) - Contains all Application rule log data. Each match between data plane and Application rule creates a log entry with the data plane packet and the matched rule's attributes.
82
-
-[Threat Intelligence log](/azure/azure-monitor/reference/tables/azfwthreatintel) - Contains all Threat Intelligence events.
83
-
-[IDPS log](/azure/azure-monitor/reference/tables/azfwidpssignature) - Contains all data plane packets that were matched with one or more IDPS signatures.
84
-
-[DNS proxy log](/azure/azure-monitor/reference/tables/azfwdnsquery) - Contains all DNS Proxy events log data.
85
-
-[Internal FQDN resolve failure log](/azure/azure-monitor/reference/tables/azfwinternalfqdnresolutionfailure) - Contains all internal Firewall FQDN resolution requests that resulted in failure.
86
-
-[Application rule aggregation log](/azure/azure-monitor/reference/tables/azfwapplicationruleaggregation) - Contains aggregated Application rule log data for Policy Analytics.
87
-
-[Network rule aggregation log](/azure/azure-monitor/reference/tables/azfwnetworkruleaggregation) - Contains aggregated Network rule log data for Policy Analytics.
88
-
-[NAT rule aggregation log](/azure/azure-monitor/reference/tables/azfwnatruleaggregation) - Contains aggregated NAT rule log data for Policy Analytics.
89
-
90
-
By default, the new resource specific tables are disabled.
91
-
92
-
Run the following Azure PowerShell commands to enable Azure Firewall Structured logs:
93
-
94
-
```azurepowershell
95
-
Connect-AzAccount
96
-
Select-AzSubscription -Subscription "subscription_id or subscription_name"
In addition, when setting up your log analytics workspace, you must select whether you want to work with the AzureDiagnostics table (default) or with Resource Specific Tables.
108
-
109
-
Additional KQL log queries were added to query structured firewall logs.
110
-
111
-
> [!NOTE]
112
-
> Existing Workbooks and any Sentinel integration will be adjusted to support the new structured logs when **Resource Specific** mode is selected.
113
-
114
-
For more information, see [Exploring the New Resource Specific Structured Logging in Azure Firewall](https://techcommunity.microsoft.com/t5/azure-network-security-blog/exploring-the-new-resource-specific-structured-logging-in-azure/ba-p/3620530).
69
+
For more information, see [Azure Structured Firewall Logs (preview)](firewall-structured-logs.md).
115
70
116
71
### Policy Analytics (preview)
117
72
@@ -125,7 +80,7 @@ You can now refine and update Firewall rules and policies with confidence in jus
125
80
126
81
#### Pricing
127
82
128
-
Enabling Policy Analytics on a Firewall Policy associated with a single firewall is billed per policy as described on the [Azure Firewall Manager pricing](https://azure.microsoft.com/pricing/details/firewall-manager/) page. Enabling Policy Analytics on a Firewall Policy associated with more than one firewall is offered at no additional cost.
83
+
Enabling Policy Analytics on a Firewall Policy associated with a single firewall is billed per policy as described on the [Azure Firewall Manager pricing](https://azure.microsoft.com/pricing/details/firewall-manager/) page. Enabling Policy Analytics on a Firewall Policy associated with more than one firewall is offered at no added cost.
129
84
130
85
#### Key Policy Analytics features
131
86
@@ -177,11 +132,11 @@ Policy analytics starts monitoring the flows in the DNAT, Network, and Applicati
177
132
178
133
### Single click upgrade/downgrade (preview)
179
134
180
-
You can now easily upgrade your existing Firewall Standard SKU to Premium SKU as well as downgrade from Premium to Standard SKU. The process is fully automated and has no service impact (zero service downtime).
135
+
You can now easily upgrade your existing Firewall Standard SKU to Premium SKU and downgrade from Premium to Standard SKU. The process is fully automated and has no service impact (zero service downtime).
181
136
182
137
In the upgrade process, you can select the policy to be attached to the upgraded Premium SKU. You can select an existing Premium Policy or an existing Standard Policy. You can use your existing Standard policy and let the system automatically duplicate, upgrade to Premium Policy, and then attach it to the newly created Premium Firewall.
183
138
184
-
This new capability is available through the Azure portal as shown here, as well as via PowerShell and Terraform simply by changing the sku_tier attribute.
139
+
This new capability is available through the Azure portal as shown here, and via PowerShell and Terraform simply by changing the sku_tier attribute.
description: Learn about Azure Structured Firewall Logs (preview)
4
+
services: firewall
5
+
author: vhorne
6
+
ms.service: firewall
7
+
ms.topic: conceptual
8
+
ms.date: 01/25/2023
9
+
ms.author: victorh
10
+
---
11
+
12
+
# Azure Structured Firewall Logs (preview)
13
+
14
+
15
+
> [!IMPORTANT]
16
+
> This feature is currently in PREVIEW.
17
+
> See the [Supplemental Terms of Use for Microsoft Azure Previews](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) for legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18
+
19
+
Currently, the following diagnostic log categories are available for Azure Firewall:
20
+
- Application rule log
21
+
- Network rule log
22
+
- DNS proxy log
23
+
24
+
These log categories use [Azure diagnostics mode](../azure-monitor/essentials/resource-logs.md#azure-diagnostics-mode). In this mode, all data from any diagnostic setting will be collected in the [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table.
25
+
26
+
With this new feature, you'll be able to choose to use [Resource Specific Tables](../azure-monitor/essentials/resource-logs.md#resource-specific) instead of the existing [AzureDiagnostics](/azure/azure-monitor/reference/tables/azurediagnostics) table. In case both sets of logs are required, at least two diagnostic settings need to be created per firewall.
27
+
28
+
## Resource specific mode
29
+
30
+
In **Resource specific** mode, individual tables in the selected workspace are created for each category selected in the diagnostic setting. This method is recommended since it:
31
+
- makes it much easier to work with the data in log queries
32
+
- makes it easier to discover schemas and their structure
33
+
- improves performance across both ingestion latency and query times
34
+
- allows you to grant Azure RBAC rights on a specific table
35
+
36
+
New resource specific tables are now available in Diagnostic setting that allows you to utilize the following newly added categories:
37
+
38
+
-[Network rule log](/azure/azure-monitor/reference/tables/azfwnetworkrule) - Contains all Network Rule log data. Each match between data plane and network rule creates a log entry with the data plane packet and the matched rule's attributes.
39
+
-[NAT rule log](/azure/azure-monitor/reference/tables/azfwnatrule) - Contains all DNAT (Destination Network Address Translation) events log data. Each match between data plane and DNAT rule creates a log entry with the data plane packet and the matched rule's attributes.
40
+
-[Application rule log](/azure/azure-monitor/reference/tables/azfwapplicationrule) - Contains all Application rule log data. Each match between data plane and Application rule creates a log entry with the data plane packet and the matched rule's attributes.
41
+
-[Threat Intelligence log](/azure/azure-monitor/reference/tables/azfwthreatintel) - Contains all Threat Intelligence events.
42
+
-[IDPS log](/azure/azure-monitor/reference/tables/azfwidpssignature) - Contains all data plane packets that were matched with one or more IDPS signatures.
43
+
-[DNS proxy log](/azure/azure-monitor/reference/tables/azfwdnsquery) - Contains all DNS Proxy events log data.
44
+
-[Internal FQDN resolve failure log](/azure/azure-monitor/reference/tables/azfwinternalfqdnresolutionfailure) - Contains all internal Firewall FQDN resolution requests that resulted in failure.
45
+
-[Application rule aggregation log](/azure/azure-monitor/reference/tables/azfwapplicationruleaggregation) - Contains aggregated Application rule log data for Policy Analytics.
46
+
-[Network rule aggregation log](/azure/azure-monitor/reference/tables/azfwnetworkruleaggregation) - Contains aggregated Network rule log data for Policy Analytics.
47
+
-[NAT rule aggregation log](/azure/azure-monitor/reference/tables/azfwnatruleaggregation) - Contains aggregated NAT rule log data for Policy Analytics.
48
+
49
+
## Enable/disable structured logs
50
+
51
+
By default, the new resource specific tables are disabled.
52
+
53
+
Run the following Azure PowerShell commands to enable Azure Firewall Structured logs:
54
+
55
+
```azurepowershell
56
+
Connect-AzAccount
57
+
Select-AzSubscription -Subscription "subscription_id or subscription_name"
In addition, when setting up your log analytics workspace, you must select whether you want to work with the AzureDiagnostics table (default) or with Resource Specific Tables.
69
+
70
+
Additional KQL log queries were added to query structured firewall logs.
71
+
72
+
> [!NOTE]
73
+
> Existing Workbooks and any Sentinel integration will be adjusted to support the new structured logs when **Resource Specific** mode is selected.
74
+
75
+
## Next steps
76
+
77
+
- For more information, see [Exploring the New Resource Specific Structured Logging in Azure Firewall](https://techcommunity.microsoft.com/t5/azure-network-security-blog/exploring-the-new-resource-specific-structured-logging-in-azure/ba-p/3620530).
78
+
79
+
80
+
- To learn more about Azure Firewall logs and metrics, see [Azure Firewall logs and metrics](logs-and-metrics.md)
0 commit comments