Unlock AD FS Insights: Monitoring Sign-ins with Microsoft Entra ID Connect Health

Table of Contents

In today’s complex hybrid identity landscapes, gaining clear visibility into user authentication activities is paramount for maintaining robust security and ensuring operational efficiency. Microsoft Entra ID Connect Health stands as a critical solution, offering a streamlined approach to integrate Active Directory Federation Services (AD FS) sign-in events directly into the comprehensive Microsoft Entra sign-ins report. This integration centralizes vital authentication data, providing administrators with a unified perspective on access patterns and potential security incidents across their hybrid environment.

The Microsoft Entra sign-ins report is a powerful tool that aggregates detailed information about various entities accessing resources within Microsoft Entra ID. This includes not only human users but also automated applications and managed resources. By channeling AD FS sign-in data into this singular report, organizations can correlate events, identify anomalies, and respond proactively to threats that might otherwise go unnoticed in disparate log systems. This article will guide you through leveraging the Connect Health for AD FS agent, alongside the analytical capabilities of Azure Monitor and Log Analytics, to effectively analyze and derive actionable insights from your AD FS sign-in data.

The Strategic Importance of Monitoring Hybrid Identity Sign-ins¶

Monitoring sign-in activities in a hybrid identity environment, encompassing both on-premises AD FS and cloud-based Microsoft Entra ID, is more than just an operational task; it is a fundamental security imperative. Every sign-in attempt, whether successful or failed, represents a potential data point in understanding user behavior, detecting unauthorized access attempts, and identifying compromised accounts. A unified monitoring approach provides a holistic view, enabling administrators to quickly pinpoint suspicious activities and enforce necessary security policies across the entire identity fabric.

Without centralized monitoring, security teams face the arduous task of sifting through logs from multiple systems, often leading to delayed detection and increased response times. The integration offered by Microsoft Entra Connect Health eliminates this siloed approach, transforming raw log data into structured, actionable insights. This capability is vital for organizations aiming to strengthen their overall security posture and comply with various regulatory requirements that mandate comprehensive audit trails of access events.

Prerequisites for Seamless AD FS Integration¶

Before you can unlock the full potential of AD FS sign-in monitoring with Microsoft Entra Connect Health, several key prerequisites must be met. Adhering to these requirements ensures that the Connect Health agent can properly collect, process, and forward AD FS event data to Microsoft Entra ID and Azure Log Analytics. These foundational steps are crucial for the stability and accuracy of the monitoring solution.

• Microsoft Entra Connect Health for AD FS Installation and Version: It is essential to have Microsoft Entra Connect Health for AD FS installed on your AD FS servers. Furthermore, the agent must be upgraded to the latest version, specifically 3.1.95.0 or greater. Newer versions often include crucial bug fixes, performance enhancements, and support for the latest features, ensuring reliable data collection and compatibility with the Microsoft Entra sign-ins report schema.
• Required Administrative Roles: To view the comprehensive Microsoft Entra sign-ins report, including data flowing from AD FS, users must be assigned specific administrative roles. These roles include the Global Administrator or Reports Reader role within Microsoft Entra ID. The Global Administrator role grants extensive permissions across the entire Microsoft Entra tenant, while the Reports Reader role provides necessary read-only access to various reports, including sign-in activity, without granting broader administrative control. This role-based access control ensures that sensitive sign-in data is only accessible to authorized personnel.
• Microsoft Entra ID P1 or P2 Licenses: Licensing is a critical component for enabling this advanced monitoring capability. At least one Microsoft Entra ID P1 or P2 license is required for the first Connect Health agent registered within your environment. Beyond the initial agent, an additional 25 Microsoft Entra ID P1 or P2 licenses are necessary for each extra registered agent. These licenses facilitate the advanced analytics and reporting features provided by Microsoft Entra ID.
• Agent Count Alignment: The total number of registered Connect Health agents across all monitored roles (AD FS, Microsoft Entra Connect, and Active Directory Domain Services) must be equal to the number of assigned licenses. For instance, if you have 3 AD FS agents, 2 Microsoft Entra Connect agents, and 1 AD DS agent, you would need licenses to cover 6 agents in total. This ensures that all components of your hybrid identity infrastructure can be monitored effectively without licensing impediments.
• Valid Microsoft Entra Connect Health Licenses: It is imperative to have the requisite number of valid Microsoft Entra Connect Health licenses. While these licenses are essential for the functionality, it’s important to note that you are not required to assign these licenses to specific individual users. The licensing model is based on the number of monitored agents, ensuring that the necessary infrastructure capabilities are provisioned.

Meeting these prerequisites establishes a solid foundation for integrating and analyzing your AD FS sign-in data, paving the way for enhanced security and operational insights.

Sign-in Data Reporting: Unveiling Actionable Insights¶

The core strength of Microsoft Entra Connect Health lies in its sophisticated sign-in data reporting capabilities. The Connect Health for AD FS agent intelligently correlates numerous event IDs from AD FS, transforming raw log entries into structured, meaningful information about sign-in requests and any associated error details if a request fails. This request information is meticulously mapped to the Microsoft Entra sign-ins report schema, providing a consistent and unified data model.

This rich, correlated data is then seamlessly displayed within the intuitive Microsoft Entra sign-in report user interface. Beyond the standard report, a new Azure Monitor workbook template and a dedicated Azure Log Analytics stream become available specifically for the AD FS data. These resources empower administrators to conduct profound analyses for a multitude of scenarios, offering unparalleled depth in understanding identity-related events.

Leveraging Azure Monitor Workbooks for In-Depth Analysis¶

Azure Monitor Workbooks are highly flexible canvases that allow you to create interactive reports and dashboards. With the AD FS data stream, you can use and modify the provided workbook template to visualize and dissect sign-in data in ways that are most relevant to your operational and security needs. Custom workbooks enable you to:

• Identify AD FS Account Lockouts: Quickly spot and analyze instances where user accounts are locked out due to repeated failed sign-in attempts. This helps in detecting brute-force attacks or identifying users who are struggling with their credentials.
• Pinpoint Bad Password Attempts: Monitor a surge in failed password attempts, which can indicate password spraying attacks or users repeatedly entering incorrect passwords. Analyzing these trends helps in proactive security measures and user education.
• Detect Spikes of Unexpected Sign-in Attempts: Visualize unusual patterns, such as sudden increases in sign-in attempts from unexpected geographic locations or at unusual times. These spikes often signal malicious activity or compromised credentials.
• Track Successful Sign-ins from Risky Locations: While not explicitly mentioned in the original text, a key benefit is the ability to track successful sign-ins originating from locations marked as risky by Microsoft Entra ID, allowing for immediate investigation.
• Analyze Multi-Factor Authentication (MFA) Failures: Identify trends in MFA failures, which could point to issues with MFA configurations, user device problems, or even MFA bypass attempts.

The data presented within these reports and workbooks mirrors the same high-fidelity information available for standard Microsoft Entra sign-ins. The report categorizes information across five distinct tabs, allowing for a focused analysis based on the sign-in type:

• Microsoft Entra ID: This tab focuses on authentications handled directly by Microsoft Entra ID.
• AD FS: This crucial tab provides specific details for sign-ins processed by your on-premises AD FS infrastructure, now visible within the unified Entra ID report.

Connect Health intelligently correlates events from AD FS, adapting its data collection based on the specific AD FS server version deployed. This ensures compatibility and accurate mapping of event IDs to the standardized AD FS schema, providing consistent and reliable data regardless of your AD FS deployment specifics. This meticulous correlation process is what makes the unified reporting experience so powerful and trustworthy.

Conceptual Data Flow Diagram for AD FS Sign-in Monitoring¶

To better understand how data flows from AD FS to Microsoft Entra ID and Azure Monitor, consider the following conceptual diagram using Mermaid syntax:

mermaid graph TD A[AD FS Servers] -->|Generate Sign-in Events| B(AD FS Event Logs) B -->|Collected by| C[Microsoft Entra Connect Health Agent] C -->|Securely Transmits Data| D[Microsoft Entra Connect Health Service] D -->|Correlates & Maps Data| E[Microsoft Entra ID Sign-ins Report] D -->|Streams Data to| F[Azure Log Analytics Workspace] E -->|Viewable in| G[Microsoft Entra Admin Center] F -->|Queryable via KQL| H[Azure Monitor Workbooks] F -->|Integrates with| I[Microsoft Sentinel] H --Query & Visualize--> J[Security Analysts / IT Admins] I --Threat Detection & Automation--> J G --Reporting & Dashboards--> J

This diagram illustrates the journey of a sign-in event from its origin on an AD FS server through the Connect Health agent, into the Microsoft Entra ID ecosystem, and finally into Azure Monitor and Log Analytics for comprehensive analysis and reporting.

Configuration and Advanced Capabilities¶

The basic configuration for integrating AD FS sign-in events is remarkably straightforward and largely automatic. Once the Microsoft Entra Connect Health for AD FS feature is live and all prerequisites are satisfied, data collection and feeding into the Microsoft Entra sign-ins report begin automatically. This ease of deployment significantly reduces the administrative overhead associated with setting up complex monitoring solutions.

Enabling Log Analytics and Azure Monitor for Deeper Insights¶

While basic reporting is automatic, you can significantly enhance your analytical capabilities by explicitly enabling Log Analytics for AD FS sign-ins. This step transforms the collected data into a powerful resource that can be leveraged with any other Log Analytics-integrated components, such as Microsoft Sentinel.

To enable Log Analytics for AD FS sign-ins, you would typically configure diagnostic settings within the Microsoft Entra admin center, selecting the AD FS sign-in logs and directing them to a chosen Log Analytics workspace. Once enabled, the data streams directly into Log Analytics, where it can be:

• Queried using Kusto Query Language (KQL): This powerful query language allows for complex data exploration, aggregation, and filtering, providing granular control over your analysis.
• Visualized in Custom Dashboards: Create personalized dashboards in Azure Monitor that combine AD FS sign-in data with other relevant metrics from your Azure environment.
• Integrated with Microsoft Sentinel: Feed the AD FS sign-in data into Microsoft Sentinel, Azure’s cloud-native Security Information and Event Management (SIEM) solution. This integration allows for advanced threat detection, correlation with other security data sources, automated incident response, and proactive hunting for sophisticated attacks. For example, Sentinel can use AD FS sign-in data to detect account compromise, anomalous sign-in patterns, or federation service abuse.

The ability to pipe AD FS sign-in data into Log Analytics and subsequently into a SIEM like Sentinel elevates your security posture by providing a centralized platform for comprehensive threat intelligence and incident management.

Basic Troubleshooting and Kusto Logging¶

While the integration is designed for robustness, occasional issues might arise. It’s always advisable to consult the frequently asked questions (FAQs) and known issues documentation provided by Microsoft for the most current information and troubleshooting guidance. These resources often cover common scenarios, limitations, and best practices.

Deep Dive into Kusto Logging for AD FS Sign-ins¶

One of the most powerful tools for troubleshooting and deep analysis of AD FS sign-in events within Log Analytics is the Kusto Query Language (KQL). KQL allows you to directly query the raw event data, providing granular control over your investigation.

To collect sign-in events specifically from AD FS, you can use a Kusto query similar to the following:

unioncluster('Idsharedweu').database('ADFSConnectHealth').SignInEvent,  
cluster('Idsharedwus').database('ADFSConnectHealth').SignInEvent 
| where env_time > ago(2d)
| where tenantId == "00000000-0000-0000-0000-000000000000" // Replace with your actual Tenant ID
| take 15

Let’s break down this Kusto query to understand its components and utility:

• unioncluster('Idsharedweu').database('ADFSConnectHealth').SignInEvent, cluster('Idsharedwus').database('ADFSConnectHealth').SignInEvent: This part of the query specifies the data sources. It’s performing a union operation across two different clusters (potentially representing different geographical regions or data partitions) where the ADFSConnectHealth database resides. Within this database, it’s targeting the SignInEvent table, which holds the correlated AD FS sign-in data.
• | where env_time > ago(2d): This is a filter condition. The where operator filters records based on a specified predicate. env_time likely refers to the timestamp of the event. ago(2d) is a time function that calculates a point in time two days prior to the current time. So, this clause retrieves all sign-in events that occurred within the last 48 hours. This is crucial for focusing on recent activity during troubleshooting.
• | where tenantId == "00000000-0000-0000-0000-000000000000": This is another filter, essential for multi-tenant environments or if you want to isolate data for a specific tenant. You must replace "00000000-0000-0000-0000-000000000000" with your actual Microsoft Entra tenant ID. This ensures you’re only querying data relevant to your organization.
• | take 15: This command is used to limit the number of records returned by the query to the first 15 results. This is particularly useful when you’re just trying to get a quick sample of the data or testing a query without retrieving a large dataset. For more comprehensive analysis, you might remove or adjust this line.

This Kusto query provides a starting point for investigating AD FS sign-in events. You can modify it to filter by specific users, IP addresses, correlation IDs, or event types to narrow down your investigation. For example, you could add:

• | where ResultType == "Failure" to see only failed sign-ins.
• | where UserPrincipalName contains "john.doe" to filter by a specific user.
• | summarize count() by ClientIP to count sign-ins from each IP address.

Mastering KQL for AD FS sign-in data in Log Analytics significantly enhances your ability to perform deep diagnostics, proactively identify security threats, and conduct thorough forensic analysis, making it an indispensable skill for any identity administrator.

Benefits of Centralized AD FS Sign-in Monitoring¶

The integration of AD FS sign-in events into Microsoft Entra ID Connect Health and Azure Monitor offers a multitude of strategic benefits for organizations managing hybrid identity infrastructures:

• Unified Visibility: Gain a single, consolidated view of all sign-in activities, whether originating from on-premises AD FS or cloud-native Microsoft Entra ID. This eliminates the need to consult disparate log sources, streamlining security operations.
• Enhanced Security Posture: Improve your ability to detect and respond to identity-based threats, such as brute-force attacks, password spraying, account lockouts, and anomalous sign-in patterns, through centralized reporting and advanced analytics. Early detection is critical for minimizing potential damage.
• Streamlined Troubleshooting: Quickly pinpoint authentication issues by correlating AD FS events with the overall sign-in process. This reduces the time spent on diagnosing user access problems and improves help desk efficiency.
• Improved Compliance and Auditing: Meet regulatory compliance requirements by maintaining comprehensive audit trails of all sign-in activities across your hybrid environment. The structured data in Azure Monitor and Log Analytics facilitates easier reporting and forensic analysis.
• Proactive Problem Identification: Leverage Azure Monitor Workbooks and KQL queries to identify emerging trends and potential issues before they escalate into major incidents. This proactive approach helps maintain the health and performance of your identity infrastructure.
• Integration with Advanced Security Tools: Seamlessly feed AD FS sign-in data into Microsoft Sentinel or other SIEM solutions, enabling more sophisticated threat hunting, automated incident response playbooks, and a broader security intelligence ecosystem.

These benefits collectively empower organizations to manage their hybrid identities more securely, efficiently, and compliantly, transforming raw data into actionable insights that drive better decision-making.

Next Steps and Continuous Improvement¶

Understanding the integration of AD FS sign-ins with Microsoft Entra ID Connect Health is just the beginning. The true value comes from actively using and continuously refining your monitoring strategy. We encourage you to delve deeper into the capabilities discussed, setting up custom alerts, creating tailored workbooks, and integrating the data with your broader security operations.

For more in-depth information and specific implementation guidance, you can always refer to the official Microsoft documentation on AD FS sign-ins in Microsoft Entra ID with Connect Health. Continuous monitoring, regular review of sign-in reports, and active participation in the security community will ensure your identity infrastructure remains robust and secure against evolving threats.

We’re always eager to hear about your experiences and insights! What challenges have you faced in monitoring AD FS sign-ins, and how has Microsoft Entra Connect Health helped you overcome them? Share your thoughts, questions, or best practices in the comments section below. Let’s build a stronger, more secure identity landscape together.