Microsoft Azure Security Center, First Edition

Chapter 8 Monitoring identity and access

These days, security monitoring goes beyond assessing the security state of your workloads. You must take a broader approach that also includes identity and access. When an adversary can compromise one user’s credentials, that adversary can leverage the legitimate account for a much larger attack campaign. Regardless of where your workloads are located—in the cloud or on-premises—it is imperative to monitor your users’ behaviors, their access, and how their credentials are used.

In this chapter, you will learn how to use Azure Security Center to monitor your users’ identity and access requests, to integrate with Azure AD Identity Protection, and to customize your search when investigating credentials ...