Monitoring Azure AD Graph Activity for Enhanced Security

By /

Listen to this Post

Featured Image
A previously undocumented diagnostic setting, AzureADGraphActivityLogs, has been introduced to address a critical visibility gap in Entra ID (Azure AD) security. While most security teams enable MicrosoftGraphActivityLogs to monitor graph.microsoft.com, the legacy Azure AD Graph API (graph.windows.net) remained a blind spot—until now.

Red Teams and adversaries often exploit this gap using tools like ROADRecon (GitHub) to enumerate tenant objects (users, groups, apps) without detection. The new AADGraphActivityLogs captures legacy API requests, providing much-needed visibility into these enumeration attempts.

You Should Know:

1. Enabling AzureADGraphActivityLogs

Since this setting is undocumented, manually configure it via PowerShell or Azure CLI:

Azure CLI:

az monitor diagnostic-settings create \ 
--resource /subscriptions/{SubID}/resourceGroups/{RG}/providers/Microsoft.AAD/domainServices/{Domain} \ 
--name "AADGraphLogs" \ 
--logs '[{"category": "AADGraphActivityLogs", "enabled": true}]' \ 
--workspace /subscriptions/{SubID}/resourcegroups/{RG}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}

PowerShell:

Set-AzDiagnosticSetting -ResourceId "/subscriptions/{SubID}/resourceGroups/{RG}/providers/Microsoft.AAD/domainServices/{Domain}" ` 
-Name "AADGraphLogs" ` 
-LogEnabled $true ` 
-Category "AADGraphActivityLogs" ` 
-WorkspaceId "/subscriptions/{SubID}/resourcegroups/{RG}/providers/microsoft.operationalinsights/workspaces/{WorkspaceName}"

2. Querying the Logs

Use KQL (Kusto Query Language) in Azure Log Analytics: 

AzureDiagnostics 
| where Category == "AADGraphActivityLogs" 
| project TimeGenerated, OperationName, CallerIPAddress, ResultType, CorrelationId

3. Detecting ROADRecon Activity

Look for suspicious patterns:

AzureDiagnostics 
| where Category == "AADGraphActivityLogs" 
| where OperationName contains "GetUser" or OperationName contains "GetGroup" 
| summarize Count=count() by CallerIPAddress, OperationName 
| where Count > 50 // Threshold for enumeration

4. Mitigation Steps

  • Disable Legacy API Access: 
    Set-MsolCompanySettings -AzureADGraphAccessBlocked $true
  • Monitor & Alert: 
    AzureDiagnostics 
| where Category == "AADGraphActivityLogs" 
| where ResultType == "401" // Failed auth attempts

5. Additional Security Hardening

  • Enable Conditional Access for Graph API calls.
  • Audit Service Principals with excessive permissions: 
    Get-AzureADServicePrincipal | Where-Object { $_.AppRoles.Count -gt 10 }

What Undercode Say

The of AADGraphActivityLogs is a crucial step toward closing a long-standing security gap. However, defenders must proactively:
– Monitor both Graph endpoints (graph.microsoft.com and graph.windows.net).
– Automate detection rules for unusual enumeration patterns.
– Phase out legacy dependencies on graph.windows.net.

Expected Output:

  • Log entries for Azure AD Graph API activity.
  • Alerts on suspicious enumeration attempts.
  • Improved detection of adversary reconnaissance.

Prediction: As attackers adapt, Microsoft will likely enforce stricter controls on legacy APIs, pushing organizations toward Microsoft Graph exclusively.

Relevant URLs:

References:

Reported By: Rad9800 If – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: