You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Configure security alerts for Azure AD roles in Privileged Identity Management
21
21
22
-
Privileged Identity Management (PIM) generates alerts when there is suspicious or unsafe activity in your organization in Azure Active Directory (Azure AD), part of Microsoft Entra. When an alert is triggered, it shows up on the Privileged Identity Management dashboard. Select the alert to see a report that lists the users or roles that triggered the alert.
22
+
Privileged Identity Management (PIM) generates alerts when there's suspicious or unsafe activity in your organization in Azure Active Directory (Azure AD), part of Microsoft Entra. When an alert is triggered, it shows up on the Privileged Identity Management dashboard. Select the alert to see a report that lists the users or roles that triggered the alert.
23
23
24
-
24
+
25
25
26
26
## Security alerts
27
27
28
28
This section lists all the security alerts for Azure AD roles, along with how to fix and how to prevent. Severity has the following meaning:
29
29
30
30
-**High**: Requires immediate action because of a policy violation.
31
-
-**Medium**: Does not require immediate action but signals a potential policy violation.
32
-
-**Low**: Does not require immediate action but suggests a preferable policy change.
31
+
-**Medium**: Doesn't require immediate action but signals a potential policy violation.
32
+
-**Low**: Doesn't require immediate action but suggests a preferable policy change.
33
33
34
34
### Administrators aren't using their privileged roles
35
35
36
36
Severity: **Low**
37
37
38
38
|| Description |
39
39
| --- | --- |
40
-
|**Why do I get this alert?**| Users that have been assigned privileged roles they don't need increases the chance of an attack. It is also easier for attackers to remain unnoticed in accounts that are not actively being used. |
41
-
|**How to fix?**| Review the users in the list and remove them from privileged roles that they do not need. |
40
+
|**Why do I get this alert?**| Users that have been assigned privileged roles they don't need increases the chance of an attack. It's also easier for attackers to remain unnoticed in accounts that aren't actively being used. |
41
+
|**How to fix?**| Review the users in the list and remove them from privileged roles that they don't need. |
42
42
|**Prevention**| Assign privileged roles only to users who have a business justification. </br>Schedule regular [access reviews](./pim-create-azure-ad-roles-and-resource-roles-review.md) to verify that users still need their access. |
43
43
|**In-portal mitigation action**| Removes the account from their privileged role. |
44
44
|**Trigger**| Triggered if a user goes over a specified number of days without activating a role. |
@@ -61,7 +61,7 @@ Severity: **Low**
61
61
62
62
|| Description |
63
63
| --- | --- |
64
-
|**Why do I get this alert?**| The current Azure AD organization does not have Azure AD Premium P2. |
64
+
|**Why do I get this alert?**| The current Azure AD organization doesn't have Azure AD Premium P2. |
65
65
|**How to fix?**| Review information about [Azure AD editions](../fundamentals/active-directory-whatis.md). Upgrade to Azure AD Premium P2. |
66
66
67
67
### Potential stale accounts in a privileged role
@@ -71,19 +71,19 @@ Severity: **Medium**
71
71
72
72
|| Description |
73
73
| --- | --- |
74
-
|**Why do I get this alert?**| This alert is no longer triggered based on the last password change date of for an account. This alert is for accounts in a privileged role that haven't signed in during the past *n* days, where *n* is a number of days that is configurable between 1-365 days. These accounts might be service or shared accounts that aren't being maintained and are vulnerable to attackers. |
74
+
|**Why do I get this alert?**| This alert is no longer triggered based on the last password change date of for an account. This alert is for accounts in a privileged role that haven't signed in during the past *n* days, where *n* is a number of days that is configurable between 1-365 days. These accounts might be service or shared accounts that aren't being maintained and are vulnerable to attackers. |
75
75
|**How to fix?**| Review the accounts in the list. If they no longer need access, remove them from their privileged roles. |
76
-
|**Prevention**| Ensure that accounts that are shared are rotating strong passwords when there is a change in the users that know the password. </br>Regularly review accounts with privileged roles using [access reviews](./pim-create-azure-ad-roles-and-resource-roles-review.md) and remove role assignments that are no longer needed. |
76
+
|**Prevention**| Ensure that accounts that are shared are rotating strong passwords when there's a change in the users that know the password. </br>Regularly review accounts with privileged roles using [access reviews](./pim-create-azure-ad-roles-and-resource-roles-review.md) and remove role assignments that are no longer needed. |
77
77
|**In-portal mitigation action**| Removes the account from their privileged role. |
78
-
|**Best practices**| Shared, service, and emergency access accounts that authenticate using a password and are assigned to highly privileged administrative roles such as Global administrator or Security administrator should have their passwords rotated for the following cases:<ul><li>After a security incident involving misuse or compromise of administrative access rights</li><li>After any user's privileges are changed so that they are no longer an administrator (for example, after an employee who was an administrator leaves IT or leaves the organization)</li><li>At regular intervals (for example, quarterly or yearly), even if there was no known breach or change to IT staffing</li></ul>Since multiple people have access to these accounts' credentials, the credentials should be rotated to ensure that people that have left their roles can no longer access the accounts. [Learn more about securing accounts](../roles/security-planning.md)|
78
+
|**Best practices**| Shared, service, and emergency access accounts that authenticate using a password and are assigned to highly privileged administrative roles such as Global administrator or Security administrator should have their passwords rotated for the following cases:<ul><li>After a security incident involving misuse or compromise of administrative access rights</li><li>After any user's privileges are changed so that they're no longer an administrator (for example, after an employee who was an administrator leaves IT or leaves the organization)</li><li>At regular intervals (for example, quarterly or yearly), even if there was no known breach or change to IT staffing</li></ul>Since multiple people have access to these accounts' credentials, the credentials should be rotated to ensure that people that have left their roles can no longer access the accounts. [Learn more about securing accounts](../roles/security-planning.md)|
79
79
80
80
### Roles are being assigned outside of Privileged Identity Management
81
81
82
82
Severity: **High**
83
83
84
84
|| Description |
85
85
| --- | --- |
86
-
|**Why do I get this alert?**| Privileged role assignments made outside of Privileged Identity Management are not properly monitored and may indicate an active attack. |
86
+
|**Why do I get this alert?**| Privileged role assignments made outside of Privileged Identity Management aren't properly monitored and may indicate an active attack. |
87
87
|**How to fix?**| Review the users in the list and remove them from privileged roles assigned outside of Privileged Identity Management. You can also enable or disable both the alert and its accompanying email notification in the alert settings. |
88
88
|**Prevention**| Investigate where users are being assigned privileged roles outside of Privileged Identity Management and prohibit future assignments from there. |
89
89
|**In-portal mitigation action**| Removes the user from their privileged role. |
@@ -95,10 +95,10 @@ Severity: **Low**
95
95
|| Description |
96
96
| --- | --- |
97
97
|**Why do I get this alert?**| Global administrator is the highest privileged role. If a Global Administrator is compromised, the attacker gains access to all of their permissions, which puts your whole system at risk. |
98
-
|**How to fix?**| Review the users in the list and remove any that do not absolutely need the Global administrator role. </br>Assign lower privileged roles to these users instead. |
98
+
|**How to fix?**| Review the users in the list and remove any that don't absolutely need the Global administrator role. </br>Assign lower privileged roles to these users instead. |
99
99
|**Prevention**| Assign users the least privileged role they need. |
100
100
|**In-portal mitigation action**| Removes the account from their privileged role. |
101
-
|**Trigger**| Triggered if two different criteria are met, and you can configure both of them. First, you need to reach a certain threshold of Global administrator role assignments. Second, a certain percentage of your total role assignments must be Global administrators. If you only meet one of these measurements, the alert does not appear. |
101
+
|**Trigger**| Triggered if two different criteria are met, and you can configure both of them. First, you need to reach a certain threshold of Global administrator role assignments. Second, a certain percentage of your total role assignments must be Global administrators. If you only meet one of these measurements, the alert doesn't appear. |
102
102
|**Minimum number of Global Administrators**| This setting specifies the number of Global Administrator role assignments, from 2 to 100, that you consider to be too few for your Azure AD organization. |
103
103
|**Percentage of Global Administrators**| This setting specifies the minimum percentage of administrators who are Global administrators, from 0% to 100%, below which you do not want your Azure AD organization to dip. |
104
104
@@ -128,11 +128,11 @@ Follow these steps to configure security alerts for Azure AD roles in Privileged
128
128
129
129
1. From the left menu, select **Alerts**, and then select **Setting**.
130
130
131
-
131
+
132
132
133
133
1. Customize settings on the different alerts to work with your environment and security goals.
134
134
135
-
135
+
# Configure security alerts for Azure roles in Privileged Identity Management
21
21
22
-
Privileged Identity Management (PIM) generates alerts when there is suspicious or unsafe activity in your organization in Azure Active Directory (Azure AD), part of Microsoft Entra. When an alert is triggered, it shows up on the Alerts page.
22
+
Privileged Identity Management (PIM) generates alerts when there's suspicious or unsafe activity in your organization in Azure Active Directory (Azure AD), part of Microsoft Entra. When an alert is triggered, it shows up on the Alerts page.
25
25
26
26
## Review alerts
27
27
28
28
Select an alert to see a report that lists the users or roles that triggered the alert, along with remediation guidance.
29
29
30
-
30
+
31
31
32
32
## Alerts
33
33
34
34
Alert | Severity | Trigger | Recommendation
35
35
--- | --- | --- | ---
36
36
**Too many owners assigned to a resource** | Medium | Too many users have the owner role. | Review the users in the list and reassign some to less privileged roles.
37
-
**Too many permanent owners assigned to a resource** | Medium | Too many users are permanently assigned to a role. | Review the users in the list and re-assign some to require activation for role use.
37
+
**Too many permanent owners assigned to a resource** | Medium | Too many users are permanently assigned to a role. | Review the users in the list and reassign some to require activation for role use.
38
38
**Duplicate role created** | Medium | Multiple roles have the same criteria. | Use only one of these roles.
39
-
**Roles are being assigned outside of Privileged Identity Management (Preview)** | High | A role is managed directly through the Azure IAM resource blade or the Azure Resource Manager API | Review the users in the list and remove them from privileged roles assigned outside of Privilege Identity Management.
39
+
**Roles are being assigned outside of Privileged Identity Management (Preview)** | High | A role is managed directly through the Azure IAM resource, or the Azure Resource Manager API. | Review the users in the list and remove them from privileged roles assigned outside of Privilege Identity Management.
40
40
41
41
> [!NOTE]
42
42
> During the public preview of the **Roles are being assigned outside of Privileged Identity Management (Preview)** alert, Microsoft supports only permissions that are assigned at the subscription level.
43
43
44
44
### Severity
45
45
46
46
-**High**: Requires immediate action because of a policy violation.
47
-
-**Medium**: Does not require immediate action but signals a potential policy violation.
48
-
-**Low**: Does not require immediate action but suggests a preferred policy change.
47
+
-**Medium**: Doesn't require immediate action but signals a potential policy violation.
48
+
-**Low**: Doesn't require immediate action but suggests a preferred policy change.
49
49
50
50
## Configure security alert settings
51
51
@@ -61,11 +61,11 @@ Follow these steps to configure security alerts for Azure roles in Privileged Id
61
61
62
62
1. On the **Alerts** page, select **Settings**.
63
63
64
-
64
+
65
65
66
66
1. Customize settings on the different alerts to work with your environment and security goals.
67
67
68
-
68
+
0 commit comments