Environment
Change Guardian 5.0
Situation
How to capture data or events for Azure AD User Accounts?
Resolution
To create capture data or events related to Azure AD User Accounts you must create a policy and assign it to the appropriate asset. To create a policy follow the instructions below.
1.) Login to the Change Guardian Policy Editor.
2.) On the left hand side select the Azure Active Directory Node then Azure Active Directory Policies.
3.) Expand the Azure Active Directory Policies and select User Accounts.
4.) Select Create Policy .
5.) On the User Account Policy window, specify the desired information to audit and a unique policy name.
Note: Specifying the specific user event type from the event list is mandatory.
6.) Click submit.
Cause
Change Guardian 5.0 added the feature to audit Azure AD User Accounts.