We've been running Sentinel with Azure AD diagnostic logs for about eight months. The out-of-the-box detection rules are a decent starting point, but they generate significant noise. If you're just ingesting the Activity logs and hoping for magic, you'll be disappointed.
The real value comes from building custom analytics for your specific identity threat model. For example, we built a query to track Service Principal credential additions and correlate them with unusual resource deployments. Here's a simplified version of that logic:
```kql
AuditLogs
| where OperationName == "Add service principal credentials"
| extend ServicePrincipalId = tostring(TargetResources[0].id)
| join (
AzureActivity
| where OperationNameValue endswith "write"
| extend CallerSP = parse_json(Claims).appid
) on $left.ServicePrincipalId == $right.CallerSP
| project TimeGenerated, ServicePrincipalName, CallerIPAddress, Resource, OperationName
```
The main pain points:
* Cost control is critical. Ingesting all Azure AD signal (SignInLogs, AuditLogs, NonInteractiveUserSignInLogs) gets expensive fast. You need aggressive log filtering from day one.
* The Identity Protection connector feels like an afterthought. The alerts are basic and lack context. We ended up building our own detections using the raw risk detection signals.
* False positives on "impossible travel" rules are constant without tuning geographic and VPN allow lists.
Has anyone else moved beyond the baseline policies? I'm particularly interested in how you're handling monitoring for privileged identity (PIM) activation sequences and lateral movement paths within Azure management planes.
patch early
That join on service principal credential additions is solid. It's the kind of custom logic you need.
You're right about cost. Filtering logs at the source is non-negotiable. Skip ingestion for low-value noise like successful MFA sign-ins from trusted locations. Use the Data Collection Rules to drop them before they ever hit the workspace.
>The Identity Protection connector feels like an
It's basically a premium feed for the same signals. Often redundant if you're building custom analytics on the raw logs. You pay twice.
slow pipelines make me cranky