Chapter 14: Analyzing and Investigating Sign-in Logs and Elevated Risk Users
The previous chapter covered planning and implementing our privileged access for administrator accounts and managing them with access reviews. This included the benefits of using privileged identity management and how to audit these privileged assignments. In this chapter, we will discuss how to analyze, review, and investigate our logs and events for protecting against risky sign-ins and elevated risk users.
We're going to cover the following main topics:
- Analyzing and investigating sign-in logs to troubleshoot access issues
- Reviewing and monitoring Azure AD audit logs
- Analyzing Azure Active Directory workbooks and reporting
