---
title: "Entra ID collector"
canonical: "https://docs.devo.com/space/latest/1198063647/Entra%20ID%20collector"
format: markdown
---
> Macro (toc)

## Purpose

An analyst wants to detect malicious authentication and privilege changes.  Using the **Entra ID collector** to send identity and access logs to Devo, the analyst will find privilege escalation events.  As a result, the analyst will remove malicious accounts, preventing them from disabling or modifying Entra ID resources.

The [Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/whatis) brand has replaced Azure Active Directory. The Entra ID collector works with over 2,000 applications, including any that support a [standard authentication method](https://learn.microsoft.com/en-us/entra/architecture/auth-sync-overview). 

Typically, Entra ID is used with Microsoft’s cloud and on-premises products.

## Example tables

| **Table** | **Description** |
| --- | --- |
| [cloud.azure](https://devodocs.atlassian.net/wiki/spaces/latest/pages/322764842).ad.* | Entra ID identity and access management logs.<br>- [What are the types of sign-in logs?](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins)
- [What can you do with audit logs?](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-audit-logs)
- [What can you do with provisioning logs?](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-provisioning-logs) |
| cloud.azure.ad.signin_all | This union table combines all the different Entra ID authentication logs. |
| [auth.all](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126107) | Authentication logs, including Entra ID. |

## Authorize it

It will take several hours to configure Entra.


Microsoft states that 

> In order to export Sign-in data, your organization needs [an Entra] P1 or P2 license.

However, some data is available with a free license.  Check with your Microsoft representative to determine which [Entra license ](https://learn.microsoft.com/en-us/entra/fundamentals/licensing#microsoft-entra-monitoring-and-health)you need to be able to secure your authentication system.  If the license for Risk (apparently P2) has been purchased then the Risk data will be collected.  Devo enables correlation of the Risk threat intelligence with on-premises log sources. 


Before beginning, obtain

- An Azure subscription.
- An [authorized event hub](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198522408).
- [Security Administrator](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference#security-administrator) access to Entra.

1. [Open Entra](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/DiagnosticSettingsMenuBlade/~/General) Diagnostic Settings.
2. Switch directories if necessary.

![image-20250211-222523.png](media://8e1f8fa5-443b-4a6d-b403-59fff14fa576)

3. [Add diagnostic setting.](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/howto-stream-logs-to-event-hub?tabs=splunk)
4. Devo recommends enabling all [log options](https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-diagnostic-settings-logs-options).
5. Enable “Stream to an event hub.”
6. Select the subscription, namespace, hub, and policy you created.
7. Save.

## Run it

The Entra ID collector is run the same way as an [Event Hub Azure collector](https://devodocs.atlassian.net/wiki/spaces/latest/pages/1198522408).

## Validate it

In Devo’s test, the diagnostic setting took 70 minutes to start working.  A login test event can be created by logging into a Microsoft service, such as [teams.microsoft.com](http://teams.microsoft.com).  An audit test event can be created by

1. Adding a group to Entra.

![image-20250228-215110.png](media://d74bc6dc-2648-4d1d-aa80-cbc13e409d07)

2. Viewing the log in Entra.
3. Viewing the log in Devo.

![image-20250228-215145.png](media://51aeb213-2d14-456a-b6fb-c5793abf0f51)

## Secure it

Use the [authentication](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#AUTH) queries from the library.

### Data destruction attempt

Find privilege escalation, including roles, groups, and administrative units.  Unexpected privilege escalation may indicate a user intends to exfiltrate or destroy data.

```
from cloud.azure.ad.audit 
where startswith(operationName,"Add"), toktains(operationName,"member to")
group by operationName as escalation_type, 
properties_initiatedBy_user_displayName as actor, 
properties_targetResources as target
```

### Identity compromise 

A password reset or change may occur when an account is compromised.

```
from cloud.azure.ad.audit 
where eq(operationName,"User started password reset") or 
(weakhas(operationName,"change") and has(operationName,"password")) or 
startswith(operationName,"Reset password")
```

### Authentication risk

Get authentication [risks](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks) detected by Microsoft.

```
from cloud.azure.ad.signin_all 
where not eq(risk_state,"none"), isnotnull(risk_state) 
group by user, risk_state, risk_detail
```

### Use risk ratings with non-Entra authentication

Match the source IP of an authentication log with the caller IP of an Azure risk event to infer relationships between risky behavior in Entra and other kinds of malicious authentication.

```
from auth.all 
select source_ipv4
select (
    from cloud.azure.ad.user_risk_events 
    group by callerIpAddress,properties__riskLevel
)[source_ipv4] as risk
```

## Monitor It

Create an [inactivity alert](https://docs.devo.com/space/latest/95126785/Inactivity+alert) to detect interruptions of transfer of data from the source to the event hub using the query

```
from cloud.azure.ad.signin_all 
where eq(action,"LOGIN"),isnotnull(application)

//Divide the applications into a few simple, but subjective, categories
select peek(application,"(?i)Azure|Office|Sharepoint|Windows|Microsoft") as application_category 
where isnotnull(application_category)

//Create an inactivity alert to detect an interruption to logins
select split(hostchain,"-",1)+" "+application_category as monitor_collector_and_application_category
```

Set the inactivity alert to keep track of the `monitor_collector_and_application_category`.  The alert will trigger if a particular collector stops receiving login events from popular applications such as Microsoft 365 Copilot (formerly Office).  This can occur if Microsoft 365 authentication is broken or if all users are on holiday.