Azure telemetry priorities
Tier 1 (day 1): Entra ID sign-in logs (interactive and non-interactive), Entra ID audit logs (user and group management, app registrations, role assignments), Azure Activity Log (subscription-level management operations). These three cover the credential and control-plane attack surface.
Tier 2: Microsoft 365 Unified Audit Log (Exchange, SharePoint, Teams, OneDrive operations), Microsoft Defender for Cloud alerts, Azure Key Vault audit logs. Tier 3: Azure Firewall logs, NSG flow logs for specific segments, individual resource diagnostic logs.
The M365 Unified Audit Log is expensive to ingest at full volume for large tenants. Prioritise: Exchange email forwarding rules, SharePoint external sharing events, Teams external access changes, and OneDrive bulk download events. These five operation types cover the highest-signal M365 exfiltration paths.
Entra ID identity monitoring
Entra ID is the identity plane for the entire Microsoft stack. Critical detections: new Global Admin role assignment, MFA method added or removed for a privileged account, conditional access policy modified, new app registration with privileged API permissions, and service principal credential added.
The ManySignal entity graph models Entra ID identities with their historical role assignments, conditional access policies, registered authentication methods, and app permission grants. A new API permission grant for a service principal — particularly Mail.ReadWrite or Files.ReadWrite — is a high-signal persistence indicator (T1098.003).
# detections/azure/global_admin_assigned.yaml
key: azure.global_admin_assigned
domain: identity
severity: critical
type: streaming
where:
class_uid: 3006 # Account Change
source: entra_id_audit
operation: "Add member to role"
role_display_name: "Global Administrator"
outcome: success
attck:
tactic: TA0004 # Privilege Escalation
techniques: [T1098.003]
stage: activeAzure control plane and resource monitoring
Azure Activity Log covers every management operation at the subscription level. Key detections: new Owner or Contributor role assignment at subscription scope, Key Vault access policy change, network security group rule added permitting inbound from 0.0.0.0/0, and diagnostic settings deleted (log tamper indicator, T1562.008).
For multi-subscription environments, use Azure Policy and the ManySignal multi-tenant connector to aggregate Activity Logs from all subscriptions into a single graph. Monitor Management Group policy changes — they propagate to all child subscriptions silently.
M365 exfiltration detection
Microsoft 365 is the primary data exfiltration path in most Microsoft-stack breaches. Three detection patterns cover the majority of cases: email forwarding rule creation (T1114.003), bulk SharePoint/OneDrive download by a single identity in a short window (volumetric anomaly), and external sharing link created for a sensitive site.
The entity graph enriches these detections with identity context: is this the first time this identity created an external sharing link? Is the download volume anomalous for this identity's 90-day baseline? These questions are what distinguish a legitimate sales rep sharing a deck from credential-compromise exfiltration.
Defender for Cloud integration
Defender for Cloud alerts should be ingested as enrichment findings in ManySignal — not as standalone alerts. They provide vulnerability and misconfiguration context that enriches the entity graph. When a Defender for Cloud alert fires for an identity or resource that is already in an active ManySignal case, the enrichment elevates the case severity automatically.
For organisations using Defender for Endpoint, integrate host telemetry via the ManySignal connector. Process creation, network connection, and file events from MDE combined with Entra ID sign-in context enable the cross-surface correlation that catches lateral movement between identity and endpoint.
Key takeaways
- Tier 1: Entra ID sign-in, Entra ID audit, Azure Activity Log — covers credential and control-plane surface.
- M365 Unified Audit Log: prioritise forwarding rules, external sharing, and bulk download operations.
- Entra ID is the identity plane for the entire Microsoft stack — model it as first-class in the entity graph.
- Defender for Cloud and Defender for Endpoint alerts are enrichment signals, not standalone alert queues.
- Multi-subscription: aggregate Activity Logs centrally and monitor Management Group policy changes.
- Bulk download anomalies require per-entity baselines — static thresholds produce unacceptable FP rates.