domains / families / security / auditing-azure-active-directory-configuration

auditing-azure-active-directory-configuration

separate

'Auditing Microsoft Entra ID (Azure Active Directory) configuration to

When to use

• When performing a security assessment of an Azure tenant's identity configuration
• When compliance audits require review of authentication policies, MFA enforcement, and role assignments
• When onboarding a new Azure tenant after merger or acquisition
• When investigating suspicious sign-in activity or compromised accounts
• When validating conditional access policies adequately protect against identity-based attacks

When not to use

• on-premises Active Directory auditing
• Azure resource-level RBAC auditing without identity context
• real-time threat detection

Skill page

Source