Azure Question posted in
The official documentation to get you started can be found here.

Make Azure Monitor alert changes to an app registration's API permissions

Is there a way I can make Azure Monitor alert an administrator when an application registration’s API permission is edited?

enter image description here

Tags:

2

Answers


  1. 0

    I think you can do this either by checking AD audit logs (but that may be more tedious and possibly doesn’t catch every condition you’re looking for):

    https://microsoft.github.io/Azure-Threat-Research-Matrix/PrivilegeEscalation/AZT405/AZT405-3/#azure-monitor-alert

    Or you could enable "Activity Logging", and for instance create a Log Analytics Workspace in Azure Monitor and build KQL queries for your use case.

    There’s all sort of clever stuff you can do with those activity logs:

    https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log?tabs=powershell

    I hope this helps, I’ve never implemented this myself though ..

    Login or Signup to reply.
  2. 0

    Is there a way I can make Azure Monitor alert an administrator when an application registration’s API permission is edited?

    1. Create a Log analytics for exporting logs from Azure AD
    2. Create a Diagnostic setting by navigating Azure Entra ID > Diagnostic settings > Add diagnostic setting

    enter image description here

    1. Once the Diagnostic settings are added, wait for some time for the logs to sync to the Log Analytics Workspace , and then execute the KQL query below to fetch logs if an application’s API permissions have been modified.
    AuditLogs
| where Category == "ApplicationManagement"
| where OperationName in ("Consent to application", "Add app role assignment to service principal", "Remove app role assignment from service principal")

    KQL Query Result:

    enter image description here

    You can follow the Stack link answered by me to create an action group for triggering an email.

    enter image description here

    Once you create an alert, you will receive a email notification to your email id if an Azure AD application’s API permission is edited.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search