Enable security and DNS audits for Microsoft Entra Domain Services

Microsoft Entra Domain Services security and DNS audits let Azure stream events to targeted resources. These resources include Azure Storage, Azure Log Analytics workspaces, or Azure Event Hub. After you enable security audit events, Domain Services sends all the audited events for the selected category to the targeted resource.

You can archive events into Azure storage and stream events into security information and event management (SIEM) software (or equivalent) using Azure Event Hubs, or do your own analysis and using Azure Log Analytics workspaces from the Microsoft Entra admin center.

Security audit destinations

You can use Azure Storage, Azure Event Hubs, or Azure Log Analytics workspaces as a target resource for Domain Services security audits. These destinations can be combined. For example, you could use Azure Storage for archiving security audit events, but an Azure Log Analytics workspace to analyze and report on the information in the short term.

The following table outlines scenarios for each destination resource type.

Enable security audit events using the Microsoft Entra admin center

To enable Domain Services security audit events using the Microsoft Entra admin center, complete the following steps.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.

2. Search for and select Microsoft Entra Domain Services. Choose your managed domain, such as aaddscontoso.com.

3. In the Domain Services window, select Diagnostic settings on the left-hand side.

4. No diagnostics are configured by default. To get started, select Add diagnostic setting.

   

5. Enter a name for the diagnostic configuration, such as aadds-auditing.

   Check the box for the security or DNS audit destination you want. You can choose from a Log Analytics workspace, an Azure Storage account, an Azure event hub, or a partner solution. These destination resources must already exist in your Azure subscription. You can't create the destination resources in this wizard.

   • Azure Log Analytic workspaces
     • Select Send to Log Analytics, then choose the Subscription and Log Analytics Workspace you want to use to store audit events.
   • Azure storage
     • Select Archive to a storage account, then choose Configure.
     • Select the Subscription and the Storage account you want to use to archive audit events.
     • When ready, choose OK.
   • Azure event hubs
     • Select Stream to an event hub, then choose Configure.
     • Select the Subscription and the Event hub namespace. If needed, also choose an Event hub name and then Event hub policy name.
     • When ready, choose OK.
   • Partner solution
     • Select Send to partner solution, then choose the Subscription and Destination you want to use to store audit events.

6. Select the log categories you want included for the particular target resource. If you send the audit events to an Azure Storage account, you can also configure a retention policy that defines the number of days to retain data. A default setting of 0 retains all data and doesn't rotate events after a period of time.

   You can select different log categories for each targeted resource within a single configuration. This ability lets you choose which logs categories you want to keep for Log Analytics and which logs categories you want to archive, for example.

7. When done, select Save to commit your changes. The target resources start to receive Domain Services audit events soon after the configuration is saved.

Enable security and DNS audit events using Azure PowerShell

To enable Domain Services security and DNS audit events using Azure PowerShell, complete the following steps. If needed, first install the Azure PowerShell module and connect to your Azure subscription.

1. Authenticate to your Azure subscription using the Connect-AzAccount cmdlet. When prompted, enter your account credentials.

   Connect-AzAccount
   

2. Create the target resource for the audit events.

   • Azure Log Analytic workspaces - Create a Log Analytics workspace with Azure PowerShell.

   • Azure storage - Create a storage account using Azure PowerShell

   • Azure event hubs - Create an event hub using Azure PowerShell. You may also need to use the New-AzEventHubAuthorizationRule cmdlet to create an authorization rule that grants Domain Services permissions to the event hub namespace. The authorization rule must include the Manage, Listen, and Send rights.

     Important

     Ensure you set the authorization rule on the event hub namespace and not the event hub itself.

3. Get the resource ID for your Domain Services managed domain using the Get-AzResource cmdlet. Create a variable named $aadds.ResourceId to hold the value:

   $aadds = Get-AzResource -name aaddsDomainName
   

4. Configure the Azure Diagnostic settings using the Set-AzDiagnosticSetting cmdlet to use the target resource for Microsoft Entra Domain Services audit events. In the following examples, the variable $aadds.ResourceId is used from the previous step.

   • Azure storage - Replace storageAccountId with your storage account name:

     Set-AzDiagnosticSetting `
         -ResourceId $aadds.ResourceId `
         -StorageAccountId storageAccountId `
         -Enabled $true
     

   • Azure event hubs - Replace eventHubName with the name of your event hub and eventHubRuleId with your authorization rule ID:

     Set-AzDiagnosticSetting -ResourceId $aadds.ResourceId `
         -EventHubName eventHubName `
         -EventHubAuthorizationRuleId eventHubRuleId `
         -Enabled $true
     

   • Azure Log Analytic workspaces - Replace workspaceId with the ID of the Log Analytics workspace:

     Set-AzureRmDiagnosticSetting -ResourceId $aadds.ResourceId `
         -WorkspaceID workspaceId `
         -Enabled $true
     

Query and view security and DNS audit events using Azure Monitor

Log Analytic workspaces let you view and analyze the security and DNS audit events using Azure Monitor and the Kusto query language. This query language is designed for read-only use that boasts power analytic capabilities with an easy-to-read syntax. For more information to get started with Kusto query languages, see the following articles:

• Azure Monitor documentation
• Get started with Log Analytics in Azure Monitor
• Get started with log queries in Azure Monitor
• Create and share dashboards of Log Analytics data

The following sample queries can be used to start analyzing audit events from Domain Services.

Sample query 1

View all the account lockout events for the last seven days:

AADDomainServicesAccountManagement
| where TimeGenerated >= ago(7d)
| where OperationName has "4740"

Sample query 2

View all the account lockout events (4740) between June 3, 2020 at 9 a.m. and June 10, 2020 midnight, sorted ascending by the date and time:

AADDomainServicesAccountManagement
| where TimeGenerated >= datetime(2020-06-03 09:00) and TimeGenerated <= datetime(2020-06-10)
| where OperationName has "4740"
| sort by TimeGenerated asc

Sample query 3

View account sign-in events seven days ago (from now) for the account named user:

AADDomainServicesAccountLogon
| where TimeGenerated >= ago(7d)
| where "user" == tolower(extract("Logon Account:\t(.+[0-9A-Za-z])",1,tostring(ResultDescription)))

Sample query 4

View account sign-in events seven days ago from now for the account named user that attempted to sign in using a bad password (0xC0000006a):

AADDomainServicesAccountLogon
| where TimeGenerated >= ago(7d)
| where "user" == tolower(extract("Logon Account:\t(.+[0-9A-Za-z])",1,tostring(ResultDescription)))
| where "0xc000006a" == tolower(extract("Error Code:\t(.+[0-9A-Fa-f])",1,tostring(ResultDescription)))

Sample query 5

View account sign-in events seven days ago from now for the account named user that attempted to sign in while the account was locked out (0xC0000234):

AADDomainServicesAccountLogon
| where TimeGenerated >= ago(7d)
| where "user" == tolower(extract("Logon Account:\t(.+[0-9A-Za-z])",1,tostring(ResultDescription)))
| where "0xc0000234" == tolower(extract("Error Code:\t(.+[0-9A-Fa-f])",1,tostring(ResultDescription)))

Sample query 6

View the number of account sign-in events seven days ago from now for all sign-in attempts that occurred for all locked out users:

AADDomainServicesAccountLogon
| where TimeGenerated >= ago(7d)
| where "0xc0000234" == tolower(extract("Error Code:\t(.+[0-9A-Fa-f])",1,tostring(ResultDescription)))
| summarize count()

Audit security and DNS event categories

Domain Services security and DNS audits align with traditional auditing for traditional AD DS domain controllers. In hybrid environments, you can reuse existing audit patterns so the same logic may be used when analyzing the events. Depending on the scenario you need to troubleshoot or analyze, the different audit event categories need to be targeted.

The following audit event categories are available:

Event IDs per category

Domain Services security and DNS audits record the following event IDs when the specific action triggers an auditable event:

Next steps

For specific information on Kusto, see the following articles:

• Overview of the Kusto query language.
• Kusto tutorial to familiarize you with query basics.
• Sample queries that help you learn new ways to see your data.
• Kusto best practices to optimize your queries for success.