Microsoft Sentinel on Anything About IT

Collect Microsoft Entra Connect Sync Audit Events

Sat, 06 Sep 2025 15:32:18 +0000

Microsoft Entra Connect Sync now includes an admin audit logging capability that is enabled by default. This gives organizations visibility into configuration changes performed by Global Administrators, Hybrid Administrators, and local server administrators.

In this post, we walk through how to forward those Microsoft Entra Connect Sync audit events into Microsoft Sentinel for centralized monitoring and investigation.

Check the Microsoft Entra Connect Sync Version

In the Entra portal, go to Entra Connect > Connect Sync > Microsoft Entra Connect Health > Sync Services > your service > Microsoft Entra Connect Servers > your server > Properties > Synchronization.

Monitoring Windows built-in local security Groups with Microsoft Defender XDR or Sentinel

Sun, 04 Feb 2024 21:50:36 +0000

Windows Built-in local security groups

Windows has several built-in local security groups that are designed to manage permissions and access rights on a computer. These groups are predefined by Windows, and each group has specific rights and permissions. The exact groups available can vary depending on the version of Windows you’re using or the features that are enabled, but here’s a general overview of the most commonly found built-in local security groups in Windows systems:

How to analyze Microsoft Sentinel Daily Cap Alerts - AADNonInteractiveUserSignInLogs

Fri, 20 May 2022 20:18:50 +0000

To avoid unplanned costs for Microsoft Sentinel, it is recommended to set a daily cap and create an analytics rule that triggers an alert when the daily cap is reached. Microsoft has published general guidance for monitoring costs here.

In the past months I have deployed a number of Microsoft Sentinel instances and in many cases the root cause for reaching the daily cap was related to data ingested into the AADNonInteractiveUserSignInLogs table. When analyzing the data we often found an individual user that created an unusually high amount of events. This can happen for various reasons such as: