Summary
In this chapter, we covered how to analyze and investigate sign-in logs and elevated risk users within Azure AD. This included sign-in logs and audit logs, and how to configure and filter reports for these logs. We looked at how to review usage and insights workbooks for activity. We also reviewed how to monitor, troubleshoot, and configure alert notifications for Azure AD Domain Services managed domains.
In the next chapter we will learn how to enable and integrate Azure AD Logs with SIEM Solutions.