Change tracking for Conditional Access Policies
Support some kind of change tracking or auditing in regards to changes made for Conditional Access Policies?
Peter Selch Dahl
shared this idea
25 comments
-
Anonymous
commented
This is a major problem for such important functions as conditional access. Impossible to believe it was actually true.
-
Nigel Doodt
commented
This needs to be an absolute priority to be implemented. Security control 101.
-
Darragh O'Shaughnessy
commented
Just came across an issue. I can't believe 'Modified Properties' within the audit trail for Conditional Access Policies is still in preview. This is an enterprise platform :|
-
Philip
commented
Meanwhile there are ways to achieve this with Log Analytics and Alerts: https://tech.nicolonsky.ch/conditional-access-and-azure-log-analytics-in-harmony/
-
Sivakumar Ramalingam
commented
This is absolutely required - its a shame that this basic level of auditing is not yet implemented and its been on "planned" stage for this long.
If there is someone from @MSFT monitoring this thread, please provide an update.
-
John McCash
commented
So.... I'm almost afraid to ask this, but if they haven't been logging something this critical from the beginning, what ELSE aren't they logging? Has anyone done a comprehensive search through their logs looking for missing information in other types of change audit log entries?
-
Tom Perkins
commented
Any update on this? It's been well over a year since this was "planned"
-
Glynn, Karen
commented
We could desperately do with this as we have just had a breach and have no way of identifying when or who did it.
-
David Vernon
commented
This would solve many headaches for us (major bank)
-
GUISADO FERRER Ernesto
commented
+1
-
Winnie Lau
commented
+1
-
Anonymous
commented
I need to know when a condicional access change is done and be notified. It's priority. A change here can leave the company work down.
-
Fred Speece
commented
not sure how to create that azure monitor rule, is there a guide somewhere?
+1, super important to be able to audit the who what when of CA policy changes. -
KjetilEVRY
commented
I think something is coming soon. Until then, you could use Azure Monitor and create alerts by using this query:
AuditLogs | where OperationName contains "Policy"Not optimal, but better than nothing
-
Anonymous
commented
This has to be done asap, how can this be justified not being done already?
-
Naveen B N
commented
This feature is really required for security governance purpose, hope fully we can find the way for achieving this.
-
David Hughes
commented
I'm trying to set-up a Conditional Access Alert for this and cannot find anything in there that would help with notification of changes etc. to CAP's.
As part of our security we need to track what was modified, by whom, and to what effect the modification was, i.e. if someone was added / removed to / from an exclude list. If the CAP itself was altered.
Does anyone know when we'll be able to log them? -
Christopher Parker
commented
I'ma be honest, folks, the fact that this is still sitting on user voice "planned" after two years is deeply, deeply disturbing.
-
Torsten Egebirk
commented
It's crusial for orgs to able able to track changes in CA's
-
Minh Trieu
commented
Considering that this is a security tool, its really important that we have audit logs for this product.