'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Create Microsoft Entra Alerts for Failed Sign-Ins and Risky Locations
Question details
The user wants to set up alerts to monitor repeated failed sign-ins and logins from high-risk locations across services like Microsoft 365, Azure, and AWS using Microsoft Entra.
- Product
- Microsoft Entra
- Device & OS
- not provided
- Scenario
- Securing organizational accounts by tracking suspicious login attempts and potential security breaches.
- Observed behavior
- The goal is to configure centralized identity alerts for failed sign-ins and risky countries across multiple cloud applications.
Ensure you have the necessary administrator permissions in Microsoft Entra ID (formerly Azure AD) and an active Log Analytics workspace to store and query the log data.
Set Up Alerts using Log Analytics and Entra Sign-in Logs
Connect your Entra ID sign-in logs to a Log Analytics workspace to create custom alert rules for failed sign-ins and high-risk locations.
To monitor multiple services like Microsoft 365, Outlook, and AWS, you need to route your identity logs to a centralized Azure Monitor Log Analytics workspace.
Once routed, you can use Kusto Query Language (KQL) to detect anomalies such as repeated failed authentication attempts or logins from unusual countries.
Navigate to the Microsoft Entra admin center. Go to Identity > Monitoring & health > Diagnostic settings. Click 'Add diagnostic setting' and select 'SignInLogs'. Route these logs to your designated Log Analytics workspace.
Open your Log Analytics workspace and select 'Logs'. Write a KQL query to filter for suspicious activity, such as 'SigninLogs | where ResultType != 0' to identify failed sign-ins, or filter by specific IP addresses and locations.
Above your query results, click 'New alert rule'. Under the 'Condition' tab, set the threshold for the number of failed attempts that should trigger the alert.
Switch to the 'Actions' tab and select or create an action group to notify administrators via email or SMS when the alert condition is met. Save the alert rule.
Looking for a Secure and Lightweight Office Suite?
While Microsoft Entra handles identity management for M365, if you are looking for a standalone, secure, and cost-effective office suite for your local document needs, consider WPS Office. It provides robust document creation without heavy cloud infrastructure dependencies.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install WPS Office: Run the downloaded installation file and follow the on-screen prompts to set up the software.
- 3. Open and Edit Office Files: Launch WPS Office and open your existing Microsoft Word, Excel, or PowerPoint documents to seamlessly continue your work.
Frequently Asked Questions
Can Microsoft Entra monitor sign-ins for third-party apps like AWS?
Yes, if AWS or other third-party applications are integrated with Microsoft Entra ID for Single Sign-On (SSO), their sign-in activity will be recorded in the centralized Entra sign-in logs.
Do I need a premium license to export Entra sign-in logs to Log Analytics?
Yes, routing Microsoft Entra sign-in logs to Azure Monitor or a Log Analytics workspace requires your tenant to have a Microsoft Entra ID P1 or P2 license.
How quickly do sign-in logs appear in Microsoft Entra for monitoring?
Generally, interactive sign-in logs appear in the Microsoft Entra admin center and Log Analytics within 2 to 5 minutes, allowing for near real-time monitoring of suspicious login issues.
