Emergency access accounts

This page's changes and edits · All guidance changes

Microsoft's edit · 21 Apr 22:27 UTC

Align article text with current Azure Monitor portal UI

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5d941b0 · +26 ~~−25~~ lines · also on GitHub

⋯ 114 unchanged lines

115115

116116 > [!NOTE]

117117 > For each additional emergency access account you want to include, add another `or UserId == "ObjectGuid"` to the query.

118 + >

119 + > The table name in these queries depends on your workspace type. Use `SigninLogs` for standard Log Analytics workspaces, or `AADSignInLogs` for Microsoft Sentinel workspaces.

118120

119121 Sample queries:

120122 ```kusto

121123 // Search for a single Object ID (UserID)

122 − AADSignInLogs

124 + SigninLogs

123125 | where UserId == "00aa00aa-bb11-cc22-dd33-44ee44ee44ee"

124126 | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

125127 ```

126128

127129 ```kusto

128130 // Search for multiple Object IDs (UserIds)

129 − AADSignInLogs

131 + SigninLogs

130132 | where UserId == "00aa00aa-bb11-cc22-dd33-44ee44ee44ee" or UserId == "11bb11bb-cc22-dd33-ee44-55ff55ff55ff"

131133 | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

132134 ```

133135

134136 ```kusto

135137 // Search for a single UserPrincipalName

136 − AADSignInLogs

138 + SigninLogs

137139 | where UserPrincipalName == "[email protected]"

138140 | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

139141 ```

140142

141143 1. Under **Alert logic**, enter the following:

142144

143 − - Based on: Number of results

144 − - Operator: Greater than

145 − - Threshold value: 0

145 + - Threshold type: **Static**

146 + - Operator: **Greater than**

147 + - Threshold value: **0**

146148

147 − 1. Under **Evaluated based on**, select the **Period (in minutes)** for how long you want the query to run, and the **Frequency (in minutes)** for how often you want the query to run. The frequency should be less than or equal to the period.

149 + 1. For **Frequency of evaluation**, select how often you want the query to run.

148150

149151 ![alert logic](./media/security-emergency-access/alert-image2.png)

150152

151 − 1. Select **Done**. You can now view the estimated monthly cost of this alert.

152 −

153 −1. Select an action group of users to be notified by the alert. If you want to create one, see [Create an action group](#create-an-action-group).

154 −

155 −1. To customize the email notification sent to the members of the action group, select actions under **Customize Actions**.

153 + 1. Select **Next** to proceed.

156154

157 −1. Under **Alert Details**, specify the alert rule name and add an optional description.

155 +1. Select an action group to be notified by the alert. If you want to create one, see [Create an action group](#create-an-action-group).

158156

159 −1. Set the **Severity level** of the event. We recommend that you set it to **Critical(Sev 0)**.

157 +1. Under **Alert rule details**, specify the alert rule name and add an optional description.

160158

161 −1. Under **Enable rule upon creation**, leave it set as **yes**.

159 +1. Set the **Severity** of the event. We recommend **0 - Critical**.

162160

163 −1. To turn off alerts for a while, select the **Suppress Alerts** check box and enter the wait duration before alerting again, and then select **Save**.

161 +1. Ensure **Enable alert rule upon creation** is selected.

164162

165 −1. Select **Create alert rule**.

163 +1. Select **Review + create**, then select **Create**.

166164

167165 ### Create an action group

168166

⋯ 1 unchanged line

170168

171169 ![create an action group for notification actions](./media/security-emergency-access/action-group-image3.png)

172170

173 −1. Enter the action group name and a short name.

171 +1. On the **Basics** tab, enter the following:

174172

175 −1. Verify the subscription and resource group.

173 + - **Subscription** and **Resource group**: Select where the action group will be stored.

174 + - **Region**: Select the region for the action group.

175 + - **Action group name**: Enter a descriptive name.

176 + - **Display name**: Enter a short name (maximum 12 characters) that appears in notifications.

176177

177 −1. Under action type, select **Email/SMS/Push/Voice**.

178 +1. Select **Next: Notifications**.

178179

179 −1. Enter an action name such as **Notify Global Administrator**.

180 +1. Under **Notification type**, select **Email/SMS message/Push/Voice**.

180181

181 −1. Select the **Action Type** as **Email/SMS/Push/Voice**.

182 +1. Enter a notification name such as **Notify Global Administrator**.

182183

183 −1. Select **Edit details** to select the notification methods you want to configure and enter the required contact information, and then select **Ok** to save the details.

184 +1. Select **Edit details**, configure the notification methods and contact information, and then select **OK**.

184185

185 −1. Add any additional actions you want to trigger.

186 +1. Add any additional notifications you want to trigger.

186187

187 −1. Select **OK**.

188 +1. Select **Next: Actions** to configure any additional automated actions, or select **Review + create** to finish.

188189

189190 ### Prepare a post-mortem team to evaluate each emergency access account credential use

190191

⋯ 34 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.