STIGQter: STIG Summary: Microsoft Entra ID Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Feb 2025:

Microsoft Entra ID must be configured to transfer logs to another server for storage, analysis, and reporting.

DISA Rule

SV-270227r1085728_rule

Vulnerability Number

V-270227

Group Title

SRG-APP-000125

Rule Version

ENTR-ID-000370

Severity

CAT II

CCI(s)

• CCI-001348 - Store audit records on an organization-defined frequency in a repository that is part of a physically different system or system component that the system or component being audited.
• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Configure the Microsoft Entra to transfer Microsoft Entra server logs to another server for storage, analysis, and reporting at least every seven days.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Browse to Identity >> Monitoring & health >> Diagnostic settings.
3. Select "+ Add diagnostic settings".
4. Select at least these required categories:
- SigninLogs.
- AuditLogs.
- ServicePrincipalSignInLogs.
- ManagedIdentitySignInLogs.
- UserRiskEvents.
- RiskyUsers.
- RiskyServicePrincipals.
- ServicePrincipalRiskEvents.
5. Select "Send to Log Analytics workspace". For details on establishing a log analytics workspace, reference the DOD365 TCG.

Check Contents

Verify Microsoft Entra ID sign-in logs are updated in Microsoft Sentinel or equivalent SIEM. Verify the Connected Status is "green" with Last Log Received within the past hour.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Browse to Identity >> Monitoring & health >> Diagnostic settings.
3. Select "Edit settings" for the entry that has an established log analytics workspace.
4. Review the selected log categories. The minimum required categories are:
- SigninLogs.
- AuditLogs.
- ServicePrincipalSignInLogs.
- ManagedIdentitySignInLogs.
- UserRiskEvents.
- RiskyUsers.
- RiskyServicePrincipals.
- ServicePrincipalRiskEvents.

If there is not an entry established to offload logs to a log analytic workspace and the minimum log categories are not selected, this is a finding.

Vulnerability Number

V-270227

Documentable

False

Rule Version

ENTR-ID-000370

Severity Override Guidance

Verify Microsoft Entra ID sign-in logs are updated in Microsoft Sentinel or equivalent SIEM. Verify the Connected Status is "green" with Last Log Received within the past hour.

1. Sign in to the Microsoft Entra admin center as a Global Administrator.
2. Browse to Identity >> Monitoring & health >> Diagnostic settings.
3. Select "Edit settings" for the entry that has an established log analytics workspace.
4. Review the selected log categories. The minimum required categories are:
- SigninLogs.
- AuditLogs.
- ServicePrincipalSignInLogs.
- ManagedIdentitySignInLogs.
- UserRiskEvents.
- RiskyUsers.
- RiskyServicePrincipals.
- ServicePrincipalRiskEvents.

If there is not an entry established to offload logs to a log analytic workspace and the minimum log categories are not selected, this is a finding.

Check Content Reference

M

Target Key

5671