Matt Zorich • 5/9/2022

Azure AD Conditional Access Insights & Auditing with Microsoft Sentinel

This technical article details how to use Microsoft Sentinel to gain insights and audit Azure AD Conditional Access, a core component of Microsoft's Zero Trust strategy. It explains how Conditional Access policies are evaluated, how to interpret sign-in logs, and demonstrates using KQL operators like mv-expand to effectively hunt through security data for multiple, complex policies.

0 comments

#Microsoft Sentinel #Zero Trust #Azure Ad