You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -78,14 +78,14 @@ To unblock a user, complete the following steps:
78
78
79
79
## Report suspicious activity
80
80
81
-
A preview of **Report Suspicious Activity**, the updated MFA **Fraud Alert** feature, is now available. When an unknown and suspicious MFA prompt is received, users can report the fraud attempt by using Microsoft Authenticator or through their phone. These alerts are integrated with [Identity Protection](../identity-protection/overview-identity-protection.md) for more comprehensive coverage and capability.
81
+
**Report suspicious activity**, the updated **MFA Fraud Alert** feature, is now available. When an unknown and suspicious MFA prompt is received, users can report the fraud attempt by using Microsoft Authenticator or through their phone. These alerts are integrated with [Identity Protection](../identity-protection/overview-identity-protection.md) for more comprehensive coverage and capability.
82
82
83
83
Users who report an MFA prompt as suspicious are set to **High User Risk**. Administrators can use risk-based policies to limit access for these users, or enable self-service password reset (SSPR) for users to remediate problems on their own. If you previously used the **Fraud Alert** automatic blocking feature and don't have an Azure AD P2 license for risk-based policies, you can use risk detection events to identify and disable impacted users and automatically prevent their sign-in. For more information about using risk-based policies, see [Risk-based access policies](../identity-protection/concept-identity-protection-policies.md).
84
84
85
-
To enable **Report Suspicious Activity** from the Authentication Methods Settings:
85
+
To enable **Report suspicious activity** from the Authentication Methods Settings:
86
86
87
87
1. In the Azure portal, click **Azure Active Directory** > **Security** > **Authentication Methods** > **Settings**.
88
-
1. Set **Report Suspicious Activity** to **Enabled**.
88
+
1. Set **Report suspicious activity** to **Enabled**.
89
89
1. Select **All users** or a specific group.
90
90
91
91
### View suspicious activity events
@@ -104,9 +104,9 @@ Once a user has reported a prompt as suspicious, the risk should be investigated
104
104
105
105
### Report suspicious activity and fraud alert
106
106
107
-
**Report Suspicious Activity** and the legacy **Fraud Alert** implementation can operate in parallel. You can keep your tenant-wide **Fraud Alert** functionality in place while you start to use **Report Suspicious Activity** with a targeted test group.
107
+
**Report suspicious activity** and the legacy **Fraud Alert** implementation can operate in parallel. You can keep your tenant-wide **Fraud Alert** functionality in place while you start to use **Report suspicious activity** with a targeted test group.
108
108
109
-
If **Fraud Alert** is enabled with Automatic Blocking, and **Report Suspicious Activity** is enabled, the user will be added to the blocklist and set as high-risk and in-scope for any other policies configured. These users will need to be removed from the blocklist and have their risk remediated to enable them to sign in with MFA.
109
+
If **Fraud Alert** is enabled with Automatic Blocking, and **Report suspicious activity** is enabled, the user will be added to the blocklist and set as high-risk and in-scope for any other policies configured. These users will need to be removed from the blocklist and have their risk remediated to enable them to sign in with MFA.
With the Azure Active Directory (Azure AD) **Usage and insights** reports, you can get an application-centric view of your sign-in data. Usage & insights also includes a report on authentication methods activity. You can find answers to the following questions:
18
+
With the Azure Active Directory (Azure AD) **Usage and insights** reports, you can get an application-centric view of your sign-in data. Usage & insights includes a report on authentication methods, service principal sign-ins, and application credential activity. You can find answers to the following questions:
19
19
20
-
* What are the top used applications in my organization?
21
-
* What applications have the most failed sign-ins?
22
-
* What are the top sign-in errors for each application?
20
+
* What are the top used applications in my organization?
21
+
* What applications have the most failed sign-ins?
22
+
* What are the top sign-in errors for each application?
23
+
* What was the date of the last sign-in for an application?
23
24
24
-
This article provides an overview of three reports that look sign-in data.
25
+
## Prerequisites
25
26
26
-
## Access Usage & insights
27
-
28
-
Accessing the data from Usage and insights requires:
27
+
To access the data from Usage and insights you must have:
29
28
30
29
* An Azure AD tenant
31
30
* An Azure AD premium (P1/P2) license to view the sign-in data
32
-
* A user in the Global Administrator, Security Administrator, Security Reader, or Reports Reader roles.
31
+
* A user in the Reports Reader, Security Reader, Security Administrator, or Global Administrator role.
32
+
33
+
## Access Usage and insights
34
+
35
+
You can access the Usage and insights reports from the Azure portal and using Microsoft Graph.
33
36
34
-
To access Usage & insights:
37
+
### To access Usage & insights in the portal:
35
38
36
39
1. Sign in to the [Azure portal](https://portal.azure.com) using the appropriate least privileged role.
37
40
1. Go to **Azure Active Directory** > **Usage & insights**.
38
41
39
-
The **Usage & insights**report is also available from the **Enterprise applications** area of Azure AD. All users can access their own sign-ins at the [My Sign-Ins portal](https://mysignins.microsoft.com/security-info).
42
+
The **Usage & insights**reports are also available from the **Enterprise applications** area of Azure AD. All users can access their own sign-ins at the [My Sign-Ins portal](https://mysignins.microsoft.com/security-info).
40
43
41
-
##View the Usage & insights reports
44
+
### To access Usage & insights using Microsoft Graph:
42
45
43
-
There are currently three reports available in Azure AD Usage & insights. All three reports use sign-in data to provide helpful information an application usage and authentication methods.
46
+
The reports can be viewed and managed using Microsoft Graph on the `/beta` endpoint in Graph Explorer.
44
47
45
-
### Azure AD application activity (preview)
48
+
1. Sign in to [Graph Explorer](https://aka.ms/ge).
49
+
1. Select **GET** as the HTTP method from the dropdown.
50
+
1. Set the API version to **beta**.
51
+
52
+
Refer to the section on each report in this article for the specific objects and parameters to include. For more information, see the [Microsoft Graph documentation for Identity and access reports](/graph/api/resources/report-identity-access).
53
+
54
+
## Azure AD application activity (preview)
46
55
47
56
The **Azure AD application activity (preview)** report shows the list of applications with one or more sign-in attempts. Any application activity during the selected date range appears in the report. The report allows you to sort by the number of successful sign-ins, failed sign-ins, and the success rate.
48
57
49
58
It's possible that activity for a deleted application may appear in the report if the activity took place during the selected date range and before the application was deleted. Other scenarios could include a user attempting to sign in to an application that doesn't have a service principal associated with the app. For these types of scenarios, you may need to review the audit logs or sign-in logs to investigate further.
50
59
51
-
Select the **View sign in activity** link for an application to view more details. The sign-in graph per application counts interactive user sign-ins. The details of any sign-in failures appears below the table.
60
+
To view the details of the sign-in activityfor an application, select the **View sign-in activity** link for the application.
52
61
53
62
54
63
55
-
Select a day in the application usage graph to see a detailed list of the sign-in activities for the application. This detailed list is actually the sign-in log with the filter set to the selected application and date.
64
+
The sign-in activity graph uses interactive user sign-ins. Select a day in the application usage graph to see a detailed list of the sign-in activities for the application. This detailed list is actually the sign-in log with the filter set to the selected application and date. The details of any sign-in failures appear below the table.
56
65
57
66
58
67
59
-
### AD FS application activity
68
+
### Application activity using Microsoft Graph
69
+
70
+
You can view the `applicationSignInSummary` or `applicationSignInDetailedSummary` of Azure AD application activity with Microsoft Graph.
71
+
72
+
Add the following query to view the **sign-in summary**, then select the **Run query** button.
73
+
74
+
```http
75
+
GET https://graph.microsoft.com/beta/reports/getAzureADApplicationSignInSummary(period='{period}')
76
+
```
77
+
78
+
Add the following query to view the **sign-in details**, then select the **Run query** button.
79
+
80
+
```http
81
+
GET https://graph.microsoft.com/beta/reports/applicationSignInDetailedSummary/{id}
82
+
```
83
+
84
+
For more information, see [Application sign-in in Microsoft Graph](/graph/api/resources/applicationsigninsummary?view=graph-rest-beta&preserve-view=true).
85
+
86
+
## AD FS application activity
60
87
61
88
The **AD FS application activity** report in Usage & insights lists all Active Directory Federated Services (AD FS) applications in your organization that have had an active user login to authenticate in the last 30 days. These applications have not been migrated to Azure AD for authentication.
62
89
63
-
### Authentication methods activity
90
+
Viewing the AD FS application activity using Microsoft Graph retrieves a list of the `relyingPartyDetailedSummary` objects, which identifies the relying party to a particular Federation Service.
91
+
92
+
Add the following query, then select the **Run query** button.
93
+
94
+
```http
95
+
GET https://graph.microsoft.com/beta/reports/getRelyingPartyDetailedSummary
96
+
```
97
+
98
+
For more information, see [AD FS application activity in Microsoft Graph](/graph/api/resources/relyingpartydetailedsummary?view=graph-rest-beta&preserve-view=true).
99
+
100
+
## Authentication methods activity
64
101
65
102
The **Authentication methods activity** in Usage & insights displays visualizations of the different authentication methods used by your organization. The **Registration tab** displays statistics of users registered for each of your available authentication methods. Select the **Usage** tab at the top of the page to see actual usage for each authentication method.
66
103
@@ -72,6 +109,108 @@ Looking for the details of a user and their authentication methods? Look at the
72
109
73
110
Looking for the status of an authentication registration or reset event of a user? Look at the **Registration and reset events** report from the side menu and then search for a name or UPN. You'll be able to see the method used to attempt to register or reset an authentication method.
74
111
112
+
## Service principal sign-in activity (preview)
113
+
114
+
The Service principal sign-in activity (preview) report provides the last activity date for every service principal. The report provides you information on the usage of the service principal - whether it was used as a client or resource app and whether it was used in an app-only or delegated context. The report shows the last time the service principal was used.
115
+
116
+
[](./media/concept-usage-insights-report/service-principal-sign-ins.png#lightbox)
117
+
118
+
Select the **View more details** link to locate the client and object IDs for the application as well as specific service principal sign-in activity.
119
+
120
+
[](./media/concept-usage-insights-report/service-principal-sign-in-activity-details.png#lightbox)
121
+
122
+
### Service principal sign-in activity using Microsoft Graph
123
+
124
+
The `servicePrincipalSignInActivity` reports can be viewed using Microsoft Graph in Graph Explorer.
125
+
126
+
Add the following query to retrieve the service principal sign-in activity, then select the **Run query** button.
127
+
128
+
```http
129
+
GET https://graph.microsoft.com/beta/reports/servicePrincipalSignInActivities/{id}
For more information, see [List service principal activity in Microsoft Graph](/graph/api/reportroot-list-serviceprincipalsigninactivities?view=graph-rest-beta&preserve-view=true).
163
+
164
+
## Application credential activity (preview)
165
+
166
+
The Application credential activity (preview) report provides the last credential activity date for every application credential. The report provides the credential type (certificate or client secret), the last used date, and the expiration date. With this report you can view the expiration dates of all your applications in one place.
167
+
168
+
To view the details of the application credential activity, select the **View more details** link. These details include the application object, service principal, and resource IDs. You can also see if the credential origin is the application or the service principal.
169
+
170
+
[](media/concept-usage-insights-report/app-credential-activity.png#lightbox)
171
+
172
+
When you select the **View more details** link, you can see the application object ID and resource ID, in addition to the details visible in the report.
173
+
174
+
[](media/concept-usage-insights-report/app-credential-activity-details.png#lightbox)
175
+
176
+
### Application credential activity using Microsoft Graph
177
+
178
+
Application credential activity can be viewed and managed using Microsoft Graph on the `/beta` endpoint. You can get the application credential sign-in activity by entity `id`, `keyId`, and `appId` .
179
+
180
+
To get started, follow these instructions to work with `appCredentialSignInActivity` using Microsoft Graph in Graph Explorer.
181
+
182
+
1. Sign in to [Graph Explorer](https://aka.ms/ge).
183
+
1. Select **GET** as the HTTP method from the dropdown.
184
+
1. Set the API version to **beta**.
185
+
1. Add the following query to retrieve recommendations, then select the **Run query** button.
186
+
187
+
```http
188
+
GET https://graph.microsoft.com/beta/reports/appCredentialSignInActivities/{id}
For more information, see [Application credential activity in Microsoft Graph](/graph/api/resources/appcredentialsigninactivity?view=graph-rest-beta&preserve-view=true).
213
+
75
214
## Next steps
76
215
77
216
-[Learn about the sign-ins report](concept-sign-ins.md)
Copy file name to clipboardExpand all lines: articles/advisor/advisor-release-notes.md
+8Lines changed: 8 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,6 +7,14 @@ ms.date: 04/18/2023
7
7
# What's new in Azure Advisor?
8
8
9
9
Learn what's new in the service. These items may be release notes, videos, blog posts, and other types of information. Bookmark this page to stay up to date with the service.
10
+
## May 2023
11
+
### Service retirement workbook
12
+
13
+
It is important to be aware of the upcoming Azure service and feature retirements to understand their impact on your workloads and plan migration. The [Service Retirement workbook](https://portal.azure.com/#view/Microsoft_Azure_Expert/AdvisorMenuBlade/~/workbooks) provides a single centralized resource level view of service retirements and helps you assess impact, evaluate options, and plan migration.
14
+
The workbook includes 35 services and features planned for retirement. You can view planned retirement dates, list and map of impacted resources and get information to make the necessary actions.
15
+
16
+
To learn more, visit [Prepare migration of your workloads impacted by service retirements](advisor-how-to-plan-migration-workloads-service-retirement.md).
17
+
10
18
## April 2023
11
19
12
20
### VM/VMSS right-sizing recommendations with custom lookback period
0 commit comments