Emergency access accounts

This page's changes and edits · All guidance changes

Microsoft's edit · 23 Apr 05:05 UTC

Rewrite alert rule and action group steps for current Azure Monitor UI

Microsoft's commit message in MicrosoftDocs/entra-docs · commit ba29d8e · +30 ~~−20~~ lines · also on GitHub

⋯ 105 unchanged lines

106106

107107 1. In the left menu, select **Alerts**.

108108

109 −1. Click **+ Create** > **Alert rule**.

109 +1. Select **+ Create** > **Alert rule**. The **Create an alert rule** page opens.

110110

111 −1. In the **Select a resource** pane, find and select your Log Analytics workspace. Select **Apply**.

111 +1. On the **Scope** tab:

112 + 1. In the **Select a resource** pane, find and select your Log Analytics workspace.

113 + 1. Verify that the subscription matches the workspace you configured in the prerequisites.

114 + 1. Select **Apply**.

112115

113 − 1. Under **Resource**, select your **Log Analytics workspace** as the resource type. Verify that the subscription matches the workspace you configured in the prerequisites.

114 − 1. Under **Condition**, select **Add**.

115 − 1. Select **Custom log search** under **Signal name**.

116 − 1. Under **Search query**, enter the following query, inserting the object IDs of the two emergency access accounts.

116 +1. On the **Condition** tab:

117 + 1. From the **Signal name** drop-down, select **Custom log search**.

118 + 1. Set the **Query type** to **Aggregated logs**.

119 + 1. Under **Search query**, enter one of the following queries, inserting the object IDs of the two emergency access accounts.

117120

118121 > [!NOTE]

119122 > For each additional emergency access account you want to include, add another `or UserId == "ObjectGuid"` to the query.

⋯ 22 unchanged lines

142145 | project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

143146 ```

144147

145 − 1. Under **Alert logic**, enter the following:

146 −

147 − - Threshold type: **Static**

148 − - Operator: **Greater than**

149 − - Threshold value: **0**

150 −

151 − 1. For **Frequency of evaluation**, select how often you want the query to run.

148 + 1. Under **Measurement**, set how to summarize the results of the query:

149 + 1. Select the **Measure**.

150 + 1. Select the **Aggregation type**.

151 + 1. Select the **Aggregation granularity**.

152 + 1. Under **Split by dimensions**, select the **Resource ID column**.

153 + 1. Under **Alert logic**:

154 + 1. Set the **Threshold type** to **Static**.

155 + 1. Set the **Operator** to **Greater than**.

156 + 1. Set the **Threshold value** to **0**.

157 + 1. Set the **Frequency of evaluation** to how often you want the query to run.

152158

153 − ![alert logic](./media/security-emergency-access/alert-image2.png)

159 + :::image type="content" source="./media/security-emergency-access/alert-logic.png" alt-text="Screenshot of Alert logic settings with example values for Threshold type, Operator, Threshold vlaue, and Frequency of evaluation." lightbox="./media/security-emergency-access/alert-logic.png":::

154160

155161 1. Select **Next** to proceed.

156162

157 −1. Select an action group to be notified by the alert. If you want to create one, see [Create an action group](#create-an-action-group).

158 −

159 −1. Under **Alert rule details**, specify the alert rule name and add an optional description.

163 +1. On the **Actions** tab, select an action group to be notified by the alert. If you want to create one, see [Create an action group](#create-an-action-group).

160164

161 −1. Set the **Severity** of the event. We recommend **0 - Critical**.

165 +1. On the **Details** tab:

166 + 1. Select the **Severity** of the event. We recommend **0 - Critical**.

167 + 1. Enter the **Alert rule name** and add an optional description.

168 + 1. Select the **Region**.

169 + 1. Select which **Identity** to use when running the log query.

170 + 1. Under **Advanced options**, select **Enable upon creation**.

171 + 1. Select **Next** to proceed.

162172

163 −1. Ensure **Enable alert rule upon creation** is selected.

173 +1. On the **Tags** tab, add any tags you want to associate with the alert rule.

164174

165175 1. Select **Review + create**, then select **Create**.

166176

⋯ 1 unchanged line

168178

169179 1. Select **Create an action group**.

170180

171 − ![create an action group for notification actions](./media/security-emergency-access/action-group-image3.png)

181 + :::image type="content" source="./media/security-emergency-access/create-action-group.png" alt-text="Screenshot of the Create an action group screen open to the Basics tab." lightbox="./media/security-emergency-access/create-action-group.png":::

172182

173183 1. On the **Basics** tab, enter the following:

174184

⋯ 53 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 04:17 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.