Setting Alerts on Azure Log Connector Activity

Configuring alert rules for Azure Log Connector events ensures your team is notified immediately when security-relevant activity occurs across your Azure and Microsoft 365 environment. This article covers the most important alert rules to configure and how to set them up in LT Auditor ^MP.

---

Understanding Azure Log Connector alerts in LT Auditor ^MP:

Azure Log Connector alert rules are configured in the Manage module as filter rules with an Alert action applied. When an incoming event matches the filter conditions, LT Auditor ^MP generates an alert and notifies the configured recipients.

Because Azure Log Connector collects events on a polling interval, alerts are near real-time rather than instantaneous — the delay is equal to your configured IntervalSeconds value (default: 5 minutes). Factor this into your incident response planning.

---

Recommended alert rules:

---

Critical priority alerts:

Alert Name	Condition	Rationale
Global Administrator Role Assigned	Operation = Add member to role AND Role = Global Administrator	Highest privilege role in Entra ID — any assignment requires immediate review
Privileged Role Assigned	Operation = Add member to role AND Role IN [privileged roles list]	Any privileged role assignment outside an approved change window is high priority
Conditional Access Policy Deleted	Operation = Delete conditional access policy	Deletion may significantly weaken your security posture
Conditional Access Policy Disabled	Operation = Update conditional access policy AND Status = Disabled	Disabling a policy may open unauthorized access paths
Risky Sign-In — High Risk	Risk Level = High	Highest severity identity threat detections from Entra ID Identity Protection
MFA Disabled for User	Operation = Update user AND MFA = Disabled	Removes a critical security control

---

High priority alerts:

Alert Name	Condition	Rationale
New Guest Account Created	Operation = Invite external user	External users may introduce data exposure risk
Bulk User Account Deletion	Operation = Delete user AND Count > [threshold] in [time window]	Mass deletions may indicate a destructive attack
Failed Sign-In Threshold Exceeded	Status = Failed AND Count > [threshold] in [time window]	High failure counts may indicate brute force or credential stuffing
Password Reset for Privileged Account	Operation = Reset password AND User IN [privileged accounts list]	Privileged account password resets require immediate verification
Service Principal Created	Operation = Add service principal	New service principals may introduce unauthorized application access
Large File Download — OneDrive	Operation = FileDownloaded AND Volume > [threshold]	High-volume downloads may indicate data exfiltration
External File Sharing — SharePoint	Operation = SharingInvitationCreated AND RecipientType = External	Files shared externally may represent unauthorized data disclosure

---

Medium priority alerts:

Alert Name	Condition	Rationale
Sign-In from Unfamiliar Location	Location NOT IN [approved countries list]	Sign-ins from unexpected locations may indicate unauthorized access
Sign-In Outside Business Hours	Status = Success AND Timestamp outside business hours	Successful sign-ins outside normal hours warrant review
Risky Sign-In — Medium Risk	Risk Level = Medium	Should be reviewed and correlated with other activity
Application Permission Granted	Operation = Add app role assignment to service principal	New application permissions may introduce data access risk
Conditional Access Policy Modified	Operation = Update conditional access policy	Policy modifications should be confirmed as authorized
SharePoint Permission Change	Operation = PermissionLevelModified	Permission changes on SharePoint sites may expand unauthorized access

---

Creating an alert rule:

The following steps walk through creating one of the recommended alert rules. Repeat the process for each alert rule you want to configure.

Example: Global Administrator Role Assigned

1. Log in to the LT Auditor ^MP Web UI
2. Navigate to Manage
3. Select the Azure Log Connector environment from the environment list
4. Select the Entra ID Audit Logs category
5. Click Add Filter
6. Configure the filter details:
   • Filter Name — Critical — Global Administrator Role Assigned
   • Description — Alerts immediately when any user is assigned the Global Administrator role
   • Priority — set to a high priority number (e.g., 1 or 2)
   • Active Status — enabled
7. Under the Conditions tab, add the following conditions:
   • Condition 1:
     • Field — Operation
     • Operator — Equals
     • Value — Add member to role
   • Condition 2 (AND):
     • Field — Role
     • Operator — Equals
     • Value — Global Administrator
8. Under the Operations tab, select the relevant Audit Log operations
9. Under the Actions tab:
   • Select Alert
   • Severity — Critical
   • Email Recipients — your security team and relevant administrators
   • Alert Frequency — Immediate
10. Click Test Filter to confirm the rule matches intended events
11. Click Save and confirm the filter is Active

---

Configuring threshold-based alerts:

For alerts based on event counts within a time window such as failed sign-ins or bulk deletions:

1. Follow the same steps above to create the filter
2. Configure the relevant field condition (e.g., Status = Failed)
3. Under Threshold settings:
   • Count — the number of events required to trigger the alert
   • Time Window — the period within which the count must be reached
4. Configure the Alert action with appropriate severity and recipients
5. Click Save

[Your administrator should determine appropriate threshold values based on normal activity patterns in your environment — thresholds set too low generate excessive noise, while thresholds set too high may miss genuine attacks.]

---

SharePoint and OneDrive specific alerts:

SharePoint and OneDrive alerts require selecting the relevant Microsoft 365 log category when creating the filter. These alerts are unique to Azure Log Connector and were not available in the previous EntraConnector module.

Recommended SharePoint and OneDrive alert configuration:

Alert	Category	Key Condition
External file sharing	SharePoint Online Logs	Operation = SharingInvitationCreated AND RecipientType = External
Large file download	OneDrive Logs	Operation = FileDownloaded AND Volume > threshold
SharePoint permission change	SharePoint Online Logs	Operation = PermissionLevelModified
Site collection admin added	SharePoint Online Logs	Operation = SiteCollectionAdminAdded
Sensitive file accessed	SharePoint Online Logs	Operation = FileAccessed AND Path CONTAINS [sensitive path]

[Your administrator should identify the SharePoint sites and OneDrive accounts that contain sensitive or regulated data and prioritize alert configuration for those locations first.]

---

Managing alert rules:

Reviewing active alerts:

1. Navigate to Alerts → Active Alerts
2. Filter by Source — Azure Log Connector to view relevant alerts
3. Review each open alert and take appropriate action
4. Resolve alerts once investigated and documented

Tuning alert rules over time:

• Review alert rules after the first two weeks of operation to identify rules generating excessive noise
• Tighten conditions on noisy rules rather than disabling them
• Add new alert rules as your understanding of normal activity patterns develops
• Review and update approved countries lists and business hours thresholds as your organization’s operations change

---

Best practices:

• Start with Critical priority alerts and confirm they are working correctly before adding Medium priority alerts
• Always test new alert rules using Test Filter before activating them in production
• Set Immediate delivery for Critical alerts so your security team is notified without delay
• Use threshold-based alerts for high-volume event types like failed sign-ins to avoid alert fatigue
• Pay particular attention to SharePoint and OneDrive alerts — external file sharing and large downloads are high-value indicators that were not previously available in LT Auditor ^MP
• Review and tune alert rules regularly as activity patterns in your Microsoft 365 environment evolve
• Document all active alert rules and their intended purpose so the configuration is auditable

[Your administrator should review the full set of Azure Log Connector alert rules at least quarterly and after any significant changes to your Azure or Microsoft 365 configuration.]