locked
Azure AD new user - alert on creation RRS feed

  • Question

  • Hi,

    I'm sending Azure AD audit logs to Azure Monitor (log analytics). I want to be able to generate an alert on the 'Add User' action, in the 'UserManagement' category in the 'Core Directory' service. I want to be able to trigger a LogicApp when a new user is created to do some auditing to ensure that required fields and groups are set.

    I can't work out how to actually find the relevant logs within Azure Monitor in order to trigger this - I'm not even sure if those specific logs are being sent as I cannot find them anywhere.

    Has anybody done anything similar (using this process or something else)? How was it achieved?

    Tom


    bs

    Thursday, October 17, 2019 1:27 AM

Answers

  • I think I worked this out.

    This query in Azure Monitor gives me results for newly created accounts. I've been able to wrap an alert group around that.

    AuditLogs | where Type == "AuditLogs" and OperationName == "Add user" and Result == "success"

    Thursday, October 17, 2019 3:20 AM

All replies

  • I think I worked this out.

    This query in Azure Monitor gives me results for newly created accounts. I've been able to wrap an alert group around that.

    AuditLogs | where Type == "AuditLogs" and OperationName == "Add user" and Result == "success"

    Thursday, October 17, 2019 3:20 AM
  • CV Global Technical, Thank you for sharing the update. Feel free to reach out to us in case you come across any other queries regarding this thread.
    Thursday, October 17, 2019 4:22 AM