You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/architecture/monitor-sign-in-health-for-resilience.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -37,7 +37,7 @@ During an impacting event, two things may happen:
37
37
- A Microsoft Entra tenant.
38
38
- A user with global administrator or security administrator role for the Microsoft Entra tenant.
39
39
- A Log Analytics workspace in your Azure subscription to send logs to Azure Monitor logs. Learn how to [create a Log Analytics workspace](../../azure-monitor/logs/quick-create-workspace.md).
40
-
- Microsoft Entra ID logs integrated with Azure Monitor logs. Learn how to [Integrate Microsoft Entra Sign- in Logs with Azure Monitor Stream.](../reports-monitoring/howto-integrate-activity-logs-with-log-analytics.md)
40
+
- Microsoft Entra ID logs integrated with Azure Monitor logs. Learn how to [Integrate Microsoft Entra sign-in logs with Azure Monitor Stream.](../reports-monitoring/howto-integrate-activity-logs-with-log-analytics.md)
### Microsoft Entra ID logs archived and integrated with incident response plans
361
+
### Microsoft Entra logs archived and integrated with incident response plans
362
362
363
-
Having access to sign-in activity, audits and risk events for Microsoft Entra ID is crucial for troubleshooting, usage analytics, and forensics investigations. Microsoft Entra ID provides access to these sources through REST APIs that have a limited retention period. A security information and event management (SIEM) system, or equivalent archival technology, is key for long-term storage of audits and supportability. To enable long-term storage of Microsoft Entra ID Logs, you must either add them to your existing SIEM solution or use [Azure Monitor](../reports-monitoring/concept-activity-logs-azure-monitor.md). Archive logs that can be used as part of your incident response plans and investigations.
363
+
Having access to sign-in activity, audits and risk events for Microsoft Entra ID is crucial for troubleshooting, usage analytics, and forensics investigations. Microsoft Entra ID provides access to these sources through REST APIs that have a limited retention period. A security information and event management (SIEM) system, or equivalent archival technology, is key for long-term storage of audits and supportability. To enable long-term storage of Microsoft Entra logs, you must either add them to your existing SIEM solution or use [Azure Monitor](../reports-monitoring/concept-activity-logs-azure-monitor.md). Archive logs that can be used as part of your incident response plans and investigations.
364
364
365
365
#### Logs recommended reading
366
366
367
367
-[Microsoft Entra ID audit API reference](/graph/api/resources/directoryaudit)
368
368
-[Microsoft Entra sign-in activity report API reference](/graph/api/resources/signin)
369
-
-[Get data using the Microsoft Entra ID Reporting API with certificates](../reports-monitoring/howto-configure-prerequisites-for-reporting-api.md)
369
+
-[Get data using the Microsoft Entra reporting API with certificates](../reports-monitoring/howto-configure-prerequisites-for-reporting-api.md)
370
370
-[Microsoft Graph for Microsoft Entra ID Protection](../identity-protection/howto-identity-protection-graph-api.md)
371
371
-[Office 365 Management Activity API reference](/office/office-365-management-api/office-365-management-activity-api-reference)
372
372
-[How to use the Microsoft Entra ID Power BI Content Pack](../reports-monitoring/howto-use-azure-monitor-workbooks.md)
@@ -386,7 +386,7 @@ There are 12 aspects to a secure Identity infrastructure. This list will help yo
386
386
- Lock down legacy authentication protocols.
387
387
- Detect and remediate illicit consent grants.
388
388
- Lock down user and group settings.
389
-
- Enable long-term storage of Microsoft Entra ID logs for troubleshooting, usage analytics, and forensics investigations.
389
+
- Enable long-term storage of Microsoft Entra logs for troubleshooting, usage analytics, and forensics investigations.
Copy file name to clipboardExpand all lines: articles/active-directory/architecture/protect-m365-from-on-premises-attacks.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -178,7 +178,7 @@ Deploy Microsoft Entra joined Windows 10 workstations with mobile device managem
178
178
179
179
-**Application and workload servers**
180
180
181
-
Applications or resources that required servers can be migrated to Azure infrastructure as a service (IaaS). Use Microsoft Entra Domain Services (Microsoft Entra DS) to decouple trust and dependency on on-premises instances of Active Directory. To achieve this decoupling, make sure virtual networks used for Microsoft Entra DS don't have a connection to corporate networks. See [Microsoft Entra Domain Services](../../active-directory-domain-services/overview.md).
181
+
Applications or resources that required servers can be migrated to Azure infrastructure as a service (IaaS). Use Microsoft Entra Domain Services to decouple trust and dependency on on-premises instances of Active Directory. To achieve this decoupling, make sure virtual networks used for Microsoft Entra Domain Services don't have a connection to corporate networks. See [Microsoft Entra Domain Services](../../active-directory-domain-services/overview.md).
182
182
183
183
Use credential tiering. Application servers are typically considered tier-1 assets. For more information, see [Enterprise access model](/security/compass/privileged-access-access-model#ADATM_BM).
184
184
@@ -198,7 +198,7 @@ Use Microsoft Entra Conditional Access to interpret signals and use them to make
198
198
199
199
## Monitor
200
200
201
-
After you configure your environment to protect your Microsoft 365 from an on-premises compromise, proactively monitor the environment. For more information, see [What is Microsoft Entra ID monitoring](../reports-monitoring/overview-monitoring.md).
201
+
After you configure your environment to protect your Microsoft 365 from an on-premises compromise, proactively monitor the environment. For more information, see [What is Microsoft Entra monitoring?](../reports-monitoring/overview-monitoring-health.md)
202
202
203
203
### Scenarios to monitor
204
204
@@ -253,9 +253,9 @@ Monitor the following key scenarios, in addition to any scenarios specific to yo
253
253
254
254
Define a log storage and retention strategy, design, and implementation to facilitate a consistent tool set. For example, you could consider security information and event management (SIEM) systems like Microsoft Sentinel, common queries, and investigation and forensics playbooks.
255
255
256
-
-**Microsoft Entra ID logs**. Ingest generated logs and signals by consistently following best practices for settings such as diagnostics, log retention, and SIEM ingestion.
256
+
-**Microsoft Entra logs**. Ingest generated logs and signals by consistently following best practices for settings such as diagnostics, log retention, and SIEM ingestion.
257
257
258
-
The log strategy must include the following Microsoft Entra ID logs:
258
+
The log strategy must include the following Microsoft Entra logs:
259
259
260
260
- Sign-in activity
261
261
- Audit logs
@@ -265,7 +265,7 @@ Define a log storage and retention strategy, design, and implementation to facil
265
265
266
266
Use the Microsoft Graph API to ingest risk events. See [Use the Microsoft Graph identity protection APIs](/graph/api/resources/identityprotection-root).
267
267
268
-
You can stream Microsoft Entra ID logs to Azure Monitor logs. See [Integrate Microsoft Entra ID logs with Azure Monitor logs](../reports-monitoring/howto-integrate-activity-logs-with-log-analytics.md).
268
+
You can stream Microsoft Entra logs to Azure Monitor logs. See [Integrate Microsoft Entra logs with Azure Monitor logs](../reports-monitoring/howto-integrate-activity-logs-with-log-analytics.md).
269
269
270
270
-**Hybrid infrastructure operating system security logs**. All hybrid identity infrastructure operating system logs should be archived and carefully monitored as a tier-0 system, because of the surface-area implications. Include the following elements:
Copy file name to clipboardExpand all lines: articles/active-directory/architecture/secure-best-practices.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -349,7 +349,7 @@ Detailed information on using automated or manual processes and tools to monitor
349
349
350
350
Some environments might have regulatory requirements that limit which data (if any) can leave a given environment. If centralized monitoring across environments isn't possible, teams should have operational procedures to correlate activities of identities across environments for auditing and forensics purposes such as cross-environment lateral movement attempts. It's recommended that the object unique identifiers human identities belonging to the same person is discoverable, potentially as part of the identity provisioning systems.
351
351
352
-
The log strategy must include the following Microsoft Entra ID logs for each tenant used in the organization:
352
+
The log strategy must include the following Microsoft Entra logs for each tenant used in the organization:
0 commit comments