Forum Discussion

Grzegorz Wierzbicki's avatar
Grzegorz Wierzbicki
Brass Contributor
Apr 18, 2019

Find events where access was blocked by specific condional access policy

Hi

In Azure Sentinel, I need to find events where access to a resource was blocked by specific conditional access policy.

Can anyone help with the query ?

azure monitor
microsoft sentinel
  • PhilQuiet's avatar
    PhilQuiet
    Copper Contributor
    May 05, 2020

    Grzegorz Wierzbicki 

     

    I know this question is over a year old but I want to answer with what I did in Log Analytics for someone else searching like I was, your where clauses will of course be different, mine was looking for legacy auth requests blocked by a particular policy:

     

    SigninLogs
| where TimeGenerated >= ago(24h)
| where ClientAppUsed !in ("Browser","Mobile Apps and Desktop Clients","")
| mvexpand PolicyResults = ConditionalAccessPolicies
| where PolicyResults.id == "<Policy ID/GUID>" and PolicyResults.result != "reportOnlyNotApplied"
| project UserPrincipalName, ClientAppUser, tostring(PolicyResults.result), TimeGenerated

    It's lines 4 and 5 that you need. Hope it helps someone

  • CliveWatson's avatar
    CliveWatson
    Icon for Microsoft rankMicrosoft
    Apr 18, 2019

    Grzegorz Wierzbicki 

     

    let policyname = "MCAS";  // some text that matches the policy name
SigninLogs
| where ConditionalAccessPolicies has policyname
| where ConditionalAccessStatus == "success"
| project AppliedConditionalAccessPolicies

    Maybe start to look for the policy name...

    • Grzegorz Wierzbicki's avatar
      Grzegorz Wierzbicki
      Brass Contributor
      May 06, 2019

      This is not it.

      ConditionalAccessPolicies is an array of all the policies found in the tenant.

      Each policy can have a status of success, notApplied or notEnabled (possibly more?)

      In PowerShell this would be a no-brainer.

      $policyid = <guid>

      $ConditionalAccessPolicies | ?{$_.id -eq $policyid -AND $_.result -eq "success"}

       

      I just don't know how do that in this query language...

      • CliveWatson's avatar
        CliveWatson
        Icon for Microsoft rankMicrosoft
        May 09, 2019

        Grzegorz Wierzbicki 

         

        More like

        SigninLogs
| where tostring(ConditionalAccessPolicies.[0].displayName) !=""
| summarize count() by //TimeGenerated,
                        CAPolicyName = tostring(ConditionalAccessPolicies.[0].displayName),                                            ConditionalAccessStatus

         

        Filter on 'success' with 

         

        SigninLogs
| where tostring(ConditionalAccessPolicies.[0].displayName) !=""
| where ConditionalAccessStatus == "success"
| summarize count() by //TimeGenerated,
                        CAPolicyName = tostring(ConditionalAccessPolicies.[0].displayName),                                            ConditionalAccessStatus

Resources