Active Directory Identity Protection Alerts & Using Microsoft Sentinel For the Deets

 Ever get one of these?

An alert that says "User at Risk Detected... We detected a new user with at least high risk in your [company] directory.  This might be because we noticed suspicious account activity or we found their emails and passwords posted in a public location."

This is Azure AD Identity Protection at work.  But if you click on "View Detailed Report" to dig into the risk events, you may get the rather vague "Unfamiliar Sign in Properties" as the source of the alert.  But.what property in particular caused this alert?  The portal doesn't seem to say.

The good news is you may be able to find the answer in Sentinel.  Use this query to look at the high risk detection:

//The details on identity protection risk detections, highlighting what you're probably looking for @tinyinfosec May, 2022
//Then go back to SignInLogs to review all recent signins in context
SecurityAlert
| where ProductName == "Azure Active Directory Identity Protection"
| extend WhatsWrong = tostring(parse_json(ExtendedProperties).["Detection Subcategory"])

 

 If, as in my case, the Detection Subcategory was "Location", turn to the SignInLogs table to see what location freaked Azure out, and review it in context of other sign-ins:

//Digging in to various properties of signins to understand the high risk signins in context
//Replace identity and town examples what whatever you're working on... there are other properties that you can add too, follow the existing as examples for syntax
SigninLogs
| where Identity contains "Smith"
| extend Town = tostring(LocationDetails.city), Browser = tostring(DeviceDetail.browser), OS = tostring(DeviceDetail.operatingSystem)
//| where Town == "Cleveland"
| summarize count() by Town, OS
 

  In my recent case, the user's unusual logon from Cleveland is what triggered the high risk detection.  But looking at the logs I could also see it was they had never signed on with an Android device until the Cleveland event.  Long story short - this alert was legit. 

  A good rule of thumb I've found is that if any product in the Microsoft stack doesn't answer all of your questions in the native interface, the data fed into Sentinel may answer those questions and provide helpful context.