The smart part comes from the ability to distinguish valid users from attackers. Twitter feed is not available at the moment.Have you ever wondered how Microsoft prevents password guessing attacks or brute force attacks on Azure AD? Well, it is basically the same method as you would do on your on-premises User Directory! It is just smarter!Īzure AD Smart lockout is a feature being applied to every sign-in processed by Azure AD, regardless if the user has a managed account or a synced accounts using password hash sync or pass-through authentication.

For a full list of services that expose logs through Azure Monitor, visit our documentation. Please also be aware that during the public preview AAD activity logs cannot yet be routed to Log Analytics, but we are working to enable this by October 2018. To learn more about the feature and get started, check out Alex Simons’s post on the Enterprise Mobility and Security blog. This will pull up the familiar Azure Monitor diagnostic setting experience, where you can create, modify, or delete diagnostic settings. For AAD logs, you can setup a tenant diagnostic setting by navigating to Audit Logs in the AAD area of the portal and clicking “Export Data Settings.” To handle this new type of “tenant-level log data,” Azure Monitor has introduced a new type of diagnostic setting, a tenant diagnostic setting.

Tenant-level services aren’t deployed as resources within an Azure subscription, rather they function across an entire AAD tenant. AAD log data is the first type of log data from a tenant-level service made available through Azure Monitor.

We often describe this type of data as “resource-level log data,” and it is configured using a resource diagnostic setting. Until now, all log data handled by Azure Monitor came from an Azure resource deployed within an Azure subscription. With today’s announcement, you will now be able to route your AAD audit and sign in logs to these same destinations, centralizing all of your Azure service logs in one pipeline. This allows you to easily route logs from any Azure service to a data archive, SIEM tool, or custom log processing tool. Azure Monitor diagnostic settings enable you to stream log data from an Azure service to three destinations: an Azure storage account, an Event Hubs namespace, and/or a Log Analytics workspace. Today in partnership with the Azure Active Directory (AAD) team we are excited to announce the public preview of AAD Activity Logs using Azure Monitor diagnostic settings.

Aad logs