Create alert if somebody creates application registration with not single tenant

Question

Hi all,

I am looking for a way to prevent/notify creating application registration with not a single tenant. I have checked many articles about it and summarized for myself next:

Direct enforcement of "Single Tenant" for App Registrations via policy is not natively supported.

Audit App Registrations using Log Analytics by monitoring Azure AD logs.

I have tried to create alert query like this:

AuditLogs

| where Category == "ApplicationManagement"

| where OperationName == "Add application" or OperationName == "Update application"

| extend appProperties = parse_json(tostring(TargetResources[0].properties))

| extend signInAudience = tostring(appProperties.signInAudience)

| where signInAudience != "AzureADMyOrg"

| project TimeGenerated, OperationName, ActivityDisplayName, InitiatedBy, signInAudience

but it shows me empty signInAudience and I'm not sure it is the correct request for this task.

Did anybody have this task and how to solve it?
Probably, another variant?

TIA

Best regards,

Viktor

Answer 1

@Viktor Korokhov Greetings!

From the details you shared, I understand that you want to enforce restrictions on application registration for single tenant and get notified on such actions. You're on the right track with monitoring *Audit Logs *via Log Analytics to detect changes related to application registrations. The issue you're facing with empty signInAudience is likely due to the structure or specific details in the logs, and the query might need slight adjustments.

In the context of application registrations, the signInAudience refers to the audience of the app (who can use it). When you're trying to capture Single Tenant applications, you want to look for those with a signInAudience of AzureADMyOrg.

The reason you're getting an empty signInAudience field might be due to the specific way the data is structured in the TargetResources field. You may need to ensure you're correctly parsing the properties section of the TargetResources for the relevant details.

You may try the below query based on common usage patterns for auditing application registrations, focusing on signInAudience:

AuditLogs

| where Category == "ApplicationManagement"

| where OperationName == "Add application" or OperationName == "Update application"

| extend appProperties = parse_json(tostring(TargetResources[0].properties))

| extend signInAudience = tostring(appProperties.signInAudience)

| where signInAudience == "AzureADMyOrg" // This will capture single tenant apps

| project TimeGenerated, OperationName, ActivityDisplayName, InitiatedBy, signInAudience

Important points to consider:

• Ensure you are parsing the properties of TargetResources correctly. The properties field in TargetResources is typically where you'll find the signInAudience information, but this can sometimes vary. Using parse_json should help to extract this field reliably.
• Ensure you're checking for the specific value AzureADMyOrg, which corresponds to Single Tenant applications.
• Make sure your Audit Logs are enabled and capturing the relevant Application Management events. Azure AD logs capture a wide variety of activities, and sometimes certain logs might not be captured depending on your logging configuration.

If you're still seeing empty fields, double-check that the TargetResources structure in the logs actually contains the signInAudience. In some cases, the field might be missing or named differently, and inspecting a raw log entry might provide clues.

You can inspect the raw log data by running a query like:

AuditLogs

| where Category == "ApplicationManagement"

| where OperationName == "Add application" or OperationName == "Update application"

| limit 10

This will help you identify exactly where the signInAudience value is stored or if it's missing.

Once you have the correct query working and capturing Single Tenant app registrations, you can set up an alert in Azure Monitor to notify you whenever such an application is registered or updated.

To create an alert:

1. In the Log Analytics workspace, go to the Alerts section.
2. Create a new Alert Rule and use the query you’ve developed as the condition.
3. Define the alert threshold (e.g., notify if any result is returned).
4. Set up the action (email, webhook, etc.) to notify the necessary people or systems.

By refining your query, you should be able to accurately capture and alert on Single Tenant application registrations.

Hope this helps. Let us know if you need further assistance or run into any issues.