Skip to content

Commit 5855857

Browse files
v-shilsv-shils
authored
Merge pull request #244175 from cwatson-cat/7-6-23-power-platform-solution
Sentinel - deploy Power Platform solution (ready to publish)
2 parents 796cebd + e191ecb commit 5855857

File tree

4 files changed

+304
-0
lines changed

4 files changed

+304
-0
lines changed

‎articles/sentinel/TOC.yml

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,14 @@
218218
href: dynamics-365/dynamics-365-finance-operations-security-content.md
219219
- name: Deploy solution
220220
href: dynamics-365/deploy-dynamics-365-finance-operations-solution.md
221+
- name: Microsoft Power Platform solution
222+
items:
223+
- name: Overview
224+
href: business-applications/power-platform-solution-overview.md
225+
- name: Content overview
226+
href: business-applications/power-platform-solution-security-content.md
227+
- name: Deploy solution
228+
href: business-applications/deploy-power-platform-solution.md
221229
- name: Integrate Microsoft Defender for IoT
222230
items:
223231
- name: Connect Defender for IoT data with Microsoft Sentinel

‎articles/sentinel/business-applications/deploy-power-platform-solution.md

Lines changed: 179 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
---
2+
title: Deploy the Microsoft Sentinel solution for Microsoft Power Platform
3+
description: Learn how to deploy the Microsoft Power Platform solution for Microsoft Sentinel.
4+
ms.author: bagol
5+
author: batamig
6+
ms.service: microsoft-sentinel
7+
ms.topic: how-to
8+
ms.date: 01/18/2024
9+
#CustomerIntent: As a security engineer, I want to ingest Power Platform activity logs into Microsoft Sentinel for security monitoring, detect related threats, and respond to incidents.
10+
---
11+
12+
# Deploy the Microsoft Sentinel solution for Microsoft Power Platform
13+
14+
The Microsoft Sentinel solution for Power Platform allows you to monitor and detect suspicious or malicious activities in your Power Platform environment. The solution collects activity logs from different Power Platform components and inventory data. For more information, see [Microsoft Sentinel solution for Microsoft Power Platform overview](power-platform-solution-overview.md).
15+
16+
> [!IMPORTANT]
17+
> - The Microsoft Sentinel solution for Power Platform is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
18+
> - The solution is a premium offering. Pricing information will be available before the solution becomes generally available.
19+
> - Provide feedback for this solution by completing this survey: [https://aka.ms/SentinelPowerPlatformSolutionSurvey](https://aka.ms/SentinelPowerPlatformSolutionSurvey).
20+
21+
## Prerequisites
22+
23+
- The Microsoft Sentinel solution is enabled.
24+
- You have a defined Microsoft Sentinel workspace and have read and write permissions to the workspace.
25+
- Your organization uses Power Platform to create and use Power Apps.
26+
- You can create an Azure Function App with the `Microsoft.Web/Sites`, `Microsoft.Web/ServerFarms`, `Microsoft.Insights/Components`, and `Microsoft.Storage/StorageAccounts` permissions.
27+
- You can create [Data Collection Rules/Endpoints](/azure/azure-monitor/essentials/data-collection-rule-overview) with the permissions to:
28+
- `Microsoft.Insights/DataCollectionEndpoints`, and `Microsoft.Insights/DataCollectionRules`.
29+
- Assign the Monitoring Metrics Publisher role to the Azure Function.
30+
- Audit logging is enabled in Microsoft Purview. For more information, see [Turn auditing on or off for Microsoft Purview](/microsoft-365/compliance/audit-log-enable-disable)
31+
- For the Power Platform inventory connector, have the following resources and configurations set up.
32+
- Storage account to use with Azure Data Lake Storage Gen2. For more information, see [Create a storage account to use with Azure Data Lake Storage Gen2](/azure/storage/blobs/create-data-lake-storage-account).
33+
- Blob service endpoint URL for the storage account. For more information, see [Get service endpoints for the storage account](/azure/storage/common/storage-account-get-info?tabs=portal#get-service-endpoints-for-the-storage-account).
34+
- Power Platform self-service analytics configured to use the Azure Data Lake Storage Gen2 storage account. This process can take up to 48 hours to activate. For more information, see [Set up Microsoft Power Platform self-service analytics to export Power Platform inventory and usage data](/power-platform/admin/self-service-analytics). Review the prerequisites and requirements for the Power Platform self-service analytics feature. The requirements include that you enable public access to the storage account and that you have the permissions required to set up the data export.
35+
- Permissions to assign Storage Blob Data Reader role to the Azure Function
36+
37+
38+
Enabling the Power Platform inventory data connector is recommended but not required to fully deploy the Microsoft Power Platform solution. For more information, see [Power Platform inventory data connector](#power-platform-inventory-data-connector).
39+
40+
## Install the Power Platform solution in Microsoft Sentinel
41+
42+
Install the solution from the content hub in Microsoft Sentinel by using the following steps.
43+
44+
1. In the Azure portal, search for and select **Microsoft Sentinel**.
45+
1. Select the Microsoft Sentinel workspace where you're planning to deploy the solution.
46+
1. Under **Content management**, select **Content hub**.
47+
1. Search for and select **Power Platform**.
48+
1. Select **Install**.
49+
1. On the solution details page, select **Create**.
50+
1. On the **Basics** tab, enter the subscription, resource group, and workspace to deploy the solution.
51+
1. Select **Review + create** > **Create** to deploy the solution.
52+
53+
## Enable the data connectors
54+
55+
In Microsoft Sentinel, enable the six data connectors to collect activity logs and inventory data from the Power Platform components.
56+
57+
### Power Platform inventory data connector
58+
59+
The Power Platform inventory data connector allows you to resolve the GUIDs for Power Platform and PowerApps environments in the incident details to the human readable names that appear in Power Platform admin center and the Power Apps maker portal. We recommend enabling this data connector but it's not required to fully deploy the Microsoft Power Platform solution.
60+
61+
To optimize ingestion, the Power Platform inventory data connector ingests data in full every 7 days and incremental updates daily. The incremental updates only include inventory assets that have changes since the previous day.
62+
63+
To collect Power Apps and Power Automate inventory data, deploy the Azure Resource Manager template to create a function app. To complete the deployment, you need the blob service URL for your Azure Data Lake Storage Gen2 storage account. After you create the function app, grant the managed identity for the function app access to the storage account.
64+
65+
66+
1. In Microsoft Sentinel, under **Configuration**, select **Data connectors**.
67+
1. Search for and select **Power Platform Inventory (using Azure Functions)**.
68+
1. Select **Open connector page**.
69+
1. If you didn't enable Power Platform self-service analytics feature, under **Configuration** follow steps 1 and 2.
70+
1. Under **Configuration** > **Step 3 - Azure Resource Manager (ARM) Template**, select **Deploy to Azure**.
71+
1. Follow all the steps in the Azure Resource Manager template deployment wizard and select **Review + create** > **Create**.
72+
1. If you don't have the required permissions for role assignments during the Resource Manager template deployment, under **Configuration**, follow steps 4 and 5.
73+
74+
### Other data connectors
75+
76+
Connect each of the remaining data connectors by completing the following steps.
77+
78+
1. In Microsoft Sentinel, under **Configuration**, select **Data connectors**.
79+
1. Search for and select the data connectors in the solution that you need to connect like **Microsoft Power Apps**.
80+
1. Select **Open connector page** > **Connect**.
81+
1. Repeat these steps for each of the following data connectors that are a part of the Power Platform solution.
82+
- **Microsoft Power Automate**
83+
- **Microsoft Power Platform Connectors**
84+
- **Microsoft Power Platform DLP**
85+
- **Microsoft Power Platform Admin Activity**
86+
- **Microsoft Dataverse**
87+
88+
## Enable auditing in your Microsoft Dataverse environment
89+
90+
Dataverse activity logging is available only for Production dataverse environments. Other types of environments, such as sandbox, don't support activity logging. See [Microsoft Dataverse and model-driven apps activity logging requirements](/power-platform/admin/enable-use-comprehensive-auditing#requirements). Dataverse activity logging isn't enabled by default. Enable auditing at the global level for Dataverse and for each Dataverse entity.
91+
92+
### Audit at the global level
93+
94+
In your Dataverse environment, go to **Settings** > **Audit settings**. Under **Auditing**, select all three checkboxes.
95+
96+
- **Start auditing**
97+
- **Log access**
98+
- **Read logs**
99+
100+
For more information about these steps, see [Manage Dataverse auditing](/power-platform/admin/manage-dataverse-auditing#startstop-auditing-for-an-environment-and-set-retention-policy).
101+
102+
### Audit Dataverse entities
103+
104+
Enable detailed auditing on each of the Dataverse entities. To enable auditing on default entities, import a Power Platform managed solution. To enable auditing on custom entities, you must manually enable detailed auditing on each of the custom entities.
105+
106+
#### Automatically enable auditing on default entities
107+
108+
The quickest way to enable default audit settings for all Dataverse entities is to import the appropriate Power Platform managed solution in your Power Platform environment. This managed solution enables detailed auditing for each of the default entities listed in the following file: [https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5eo4g](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE5eo4g). To enable auditing on custom entities, you must manually enable detailed auditing on each of the custom entities.
109+
110+
To automatically enable entity auditing, complete the following steps.
111+
112+
1. Go to [https://make.powerapps.com](https://make.powerapps.com).
113+
1. Choose the environment you want to monitor from the top right-hand side of the page.
114+
1. Go to **Solutions** > **Import solution**.
115+
1. Import one of the following solutions depending on whether your Power Platform environment is used for Dynamics 365 CE Apps or not.
116+
117+
- For use with Dynamics 365 CE Apps, import [https://aka.ms/AuditSettings/Dynamics](https://aka.ms/AuditSettings/Dynamics).
118+
- Otherwise, import [https://aka.ms/AuditSettings/DataverseOnly](https://aka.ms/AuditSettings/DataverseOnly).
119+
120+
#### Manually enable entity auditing
121+
122+
To enable auditing on each Dataverse entity manually, including custom entities, follow the steps in the section **Enable or disable entities and fields for auditing** in [Manage Dataverse auditing](/power-platform/admin/manage-dataverse-auditing#enable-or-disable-entities-and-fields-for-auditing).
123+
124+
To get the full incident detection value of the solution, we recommend that you enable, for each Dataverse entity you want to audit, the following options in the **General** tab of the Dataverse entity settings page:
125+
- Under the **Data Services** section, select **Auditing**.
126+
- Under the **Auditing** section, select **Single record auditing** and **Multiple record auditing**.
127+
128+
Save and publish your customizations.
129+
130+
## Verify that the data connector is ingesting logs to Microsoft Sentinel
131+
132+
To verify that log ingestion is working, complete the following steps.
133+
134+
### Generate activity and inventory logs
135+
136+
1. Run activities like create, update, and delete to generate logs for data that you enabled for monitoring.
137+
1. Wait up to 60 minutes for Microsoft Sentinel to ingest the activity logs to the logs table in the workspace.
138+
1. For Power Platform inventory data, wait up to 24 hours for Microsoft Sentinel to ingest the data to the log tables in the workspace.
139+
140+
### View ingested data in Microsoft Sentinel
141+
142+
After you wait for Microsoft Sentinel to ingest the data, complete the following steps to verify you get the data you expect.
143+
144+
1. In Microsoft Sentinel, select **Logs**.
145+
1. Run KQL queries against the tables that collect the activity logs from the data connectors. For example, run the following query to return 50 rows from the table with the Power Apps activity logs.
146+
147+
```kusto
148+
PowerAppsActivity
149+
| take 50
150+
```
151+
152+
The following table lists the Log Analytics tables to query.
153+
154+
|Log Analytics tables |Data collected |
155+
|---------|---------|
156+
|PowerAppsActivity |Power Apps activity logs |
157+
|PowerAutomateActivity |Power Automate activity logs |
158+
|PowerPlatformConnectorActivity |Power Platform connector activity logs |
159+
|PowerPlatformDlpActivity |Data loss prevention activity logs |
160+
|PowerPlatformAdminActivity|Power Platform administrative logs|
161+
|DataverseActivity |Dataverse and model-driven apps activity logging |
162+
163+
Use the following parsers to return inventory and watchlist data.
164+
165+
|Parser |Data returned |
166+
|---------|---------|
167+
|`InventoryApps` | Power Apps Inventory |
168+
|`InventoryAppsConnections` | Power Apps connections Inventoryconnections |
169+
|`InventoryEnvironments` |Power Platform environments Inventory |
170+
|`InventoryFlows` | Power Automate flows Inventory |
171+
|`MSBizAppsTerminatedEmployees` | Terminated employees watchlist |
172+
1. Verify that the results for each table show the activities you generated.
173+
174+
## Next steps
175+
176+
In this article, you learned how to deploy the Microsoft Sentinel solution for Power Platform.
177+
178+
- To review the solution content available with this solution, see [Microsoft Sentinel solution for Microsoft Power Platform: security content reference](power-platform-solution-security-content.md).
179+
- To manage the solution components and enable security content, see [Discover and deploy out-of-the-box content](/azure/sentinel/sentinel-solutions-deploy).

‎articles/sentinel/business-applications/power-platform-solution-overview.md

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
---
2+
title: Microsoft Sentinel solution for Microsoft Power Platform overview
3+
description: Learn about the Microsoft Sentinel Solution for Power Platform.
4+
author: batamig
5+
ms.author: bagol
6+
ms.topic: conceptual
7+
ms.date: 01/18/2024
8+
---
9+
10+
# Microsoft Sentinel solution for Microsoft Power Platform overview
11+
12+
The Microsoft Sentinel solution for Power Platform allows you to monitor and detect suspicious or malicious activities in your Power Platform environment. The solution collects activity logs from different Power Platform components and inventory data. It analyzes those activity logs to detect threats and suspicious activities like the following activities:
13+
14+
- Power Apps execution from unauthorized geographies
15+
- Suspicious data destruction by Power Apps
16+
- Mass deletion of Power Apps
17+
- Phishing attacks made possible through Power Apps
18+
- Power Automate flows activity by departing employees
19+
- Microsoft Power Platform connectors added to the environment
20+
- Update or removal of Microsoft Power Platform data loss prevention policies
21+
22+
> [!IMPORTANT]
23+
> - The Microsoft Sentinel solution for Power Platform is currently in PREVIEW. The [Azure Preview Supplemental Terms](https://azure.microsoft.com/support/legal/preview-supplemental-terms/) include additional legal terms that apply to Azure features that are in beta, preview, or otherwise not yet released into general availability.
24+
> - The solution is a premium offering. Pricing information will be available before the solution becomes generally available.
25+
> - Provide feedback for this solution by completing this survey: [https://aka.ms/SentinelPowerPlatformSolutionSurvey](https://aka.ms/SentinelPowerPlatformSolutionSurvey).
26+
27+
## Why you should install the solution
28+
29+
The Microsoft Sentinel solution for Microsoft Power Platform helps organizations to:
30+
31+
- Collect Microsoft Power Platform and Power Apps activity logs, audits, and events into the Microsoft Sentinel workspace.
32+
- Detect execution of suspicious, malicious, or illegitimate activities within Microsoft Power Platform and Power Apps.
33+
- Investigate threats detected in Microsoft Power Platform and Power Apps and contextualize them with other user activities across the organization.
34+
- Respond to Microsoft Power Platform-related and Power Apps-related threats and incidents in a simple and canned manner manually, automatically, or through a predefined workflow.
35+
36+
## What the solution includes
37+
38+
The Microsoft Sentinel solution for Power Platform includes several data connectors and analytic rules.
39+
40+
### Data connectors
41+
42+
The Microsoft Sentinel solution for Power Platform ingests and cross-correlates activity logs and inventory data from multiple sources. So, the solution requires that you enable the following data connectors that are available as part of the solution.
43+
44+
|Connector name |Data collected |Log Analytics tables |
45+
|---------|---------|---------|
46+
|Power Platform Inventory (using Azure Functions) | Power Apps and Power Automate inventory data <br><br> For more information, see [Set up Microsoft Power Platform self-service analytics to export Power Platform inventory and usage data](/power-platform/admin/self-service-analytics). | PowerApps_CL,<br>PowerPlatrformEnvironments_CL,<br>PowerAutomateFlows_CL,<br>PowerAppsConnections_CL |
47+
|Microsoft Power Apps (Preview) | Power Apps activity logs <br><br> For more information, see [Power Apps activity logging](/power-platform/admin/logging-powerapps). | PowerAppsActivity |
48+
|Microsoft Power Automate (Preview) | Power Automate activity logs <br><br>For more information, see [View Power Automate audit logs](/power-platform/admin/logging-power-automate). | PowerAutomateActivity |
49+
|Microsoft Power Platform Connectors (Preview) | Power Platform connector activity logs <br><br>For more information, see [View the Power Platform connector activity logs](/power-platform/admin/connector-events-power-platform). | PowerPlatformConnectorActivity |
50+
|Microsoft Power Platform DLP (Preview) | Data loss prevention activity logs <br><br>For more information, see [Data loss prevention activity logging](/power-platform/admin/dlp-activity-logging). | PowerPlatformDlpActivity |
51+
|Microsoft Power Platform Admin Activity (Preview)|Power Platform administrator activity logs<br><Br> For more information, see [View Power Platform administrative logs using auditing solutions in Microsoft Purview (preview)](/power-platform/admin/admin-activity-logging).||
52+
|Microsoft Dataverse (Preview) | Dataverse and model-driven apps activity logging <br><br>For more information, see [Microsoft Dataverse and model-driven apps activity logging](/power-platform/admin/enable-use-comprehensive-auditing).<br><br>If you use the data connector for Dynamics 365, migrate to the data connector for Microsoft Dataverse. This data connector replaces the legacy data connector for Dynamics 365 and supports data collection rules. | DataverseActivity |
53+
54+
### Analytic rules
55+
56+
The solution includes analytics rules to detect threats and suspicious activity in your Power Platform environment. These activities include Power Apps being run from unauthorized geographies, suspicious data destruction by Power Apps, mass deletion of Power Apps, and more. For more information, see [Microsoft Sentinel solution for Microsoft Power Platform: security content reference](power-platform-solution-security-content.md).
57+
58+
## Parsers
59+
60+
The solution includes parsers that are used to access data from the raw data tables. Parsers ensure that the correct data is returned with a consistent schema. We recommend that you use the parsers instead of directly querying the inventory tables and watchlists. For more information, see [Microsoft Sentinel solution for Microsoft Power Platform: security content reference](power-platform-solution-security-content.md).
61+
62+
## Next steps
63+
64+
[Deploy the Microsoft Sentinel solution for Microsoft Power Platform](deploy-power-platform-solution.md)

0 commit comments

Comments
 (0)