Daily.Entra.News
Aboutmerill.net
Cross-product topic

Monitoring

A cross-product view of Microsoft Entra changes related to Monitoring.

Latest Monitoring changes

Sla Performance

Monitoring

The August row on the SLA performance reference page now shows 99.999% in the previously blank final metric column.

The Risky IP report

Monitoring

The documentation now notes that the AD FS Risky IP report is being deprecated and links to the Risky IP report workbook. It also updates portal navigation, export handling, notification settings, and threshold guidance.

Using Microsoft Entra Connect Health with AD DS

Monitoring

The guide now documents the updated service overview, alert details and search, domain controller filtering and column options, replication error details, and 24-hour authentication performance charts.

Policy Teams Devices Device Code Flow

Monitoring

The instructions now direct administrators to choose Resources > Specific resources, instead of Cloud apps, when adding Device Registration Service to the exclusion list.

Policy Teams Devices Device Code Flow

Monitoring

The guide now directs administrators to use Exclude > Select resources > Select specific resources before adding Device Registration Service.

Privileged Roles Permissions

Monitoring

The documentation now lists Security Administrator alongside Security Operator and Entra SOC Identity Responder as limited to non-administrative user accounts and unable to act on privileged accounts.

Sla Performance

Monitoring

The July row now includes an additional 99.999% value in the performance table; no product change is indicated.

Sla Performance

Monitoring

| March | 99.568% | 99.998% | 99.999% | 99.999% | 99.996% | 99.999% |

Ad Group Enforcement

Monitoring

.\Set-CloudSyncSOAPolicy.ps1 -EnforcementMode Audit -Credential (Get-Credential -Message "Enter Domain Admin credentials (format: DOMAIN\Username)")

Create Review Difference Reports

Monitoring

You need at least the **Microsoft Entra Backup Reader** role to review difference reports. To review and create difference reports, you need the **Microsoft Entra Backup Administrator** role. The **Global Administrator** role also includes these permissions.

PowerShell samples for Global Secure Access

Monitoring

Use these PowerShell samples to automate common Global Secure Access tasks, including connector registration, client install, traffic forwarding bypasses, break glass scenarios, TLS certificate creation, operations monitoring, and recovery.

Best Practices Agent Id

Monitoring

Learn operational best practices for designing, securing, and governing AI agent identities with Microsoft Entra Agent ID, including blueprint design, credential management, access controls, and monitoring strategies.

Agent Id Creation Channels

Monitoring

Learn about the ways to create Microsoft Entra agent identity blueprints, agent identities, and agents' user accounts as well as monitor and control their introduction into your tenant.

Best practices for Microsoft Entra Agent ID

Monitoring

Learn operational best practices for designing, securing, and governing AI agent identities with Microsoft Entra Agent ID, including blueprint design, credential management, access controls, and monitoring strategies.

Export Connector Logs

Monitoring

Extract connector logs and send those logs to the Log Analytics workspace in the customer’s Azure subscription.

How to use Microsoft Entra workbooks

Monitoring

Learn how to use Azure Monitor workbooks for Microsoft Entra ID, for analyzing identity related activity, trends, and gaps.

Sensitive operations report workbook

Monitoring

Learn how to use the sensitive operations report workbook in Microsoft Entra ID to explore suspicious app and service principal activity.

Using Microsoft Entra Connect Health with AD DS

Monitoring

The following documentation is specific to monitoring Active Directory Domain Services with Microsoft Entra Connect Health. The supported versions of AD DS are Windows Server 2016, 2019, 2022, and 2025.

Operate Private Access

Monitoring

| Connector high resource usage | CPU > 80% or memory > 85% sustained for 15+ minutes on a connector host | Network Ops L1 | Azure Monitor alert ([Playbook 5](#playbook-5-connector-group-capacity-alert)) | 1. Check the number of active sessions on the connector.<br>2. Redistribute load by adding another connector to the group.<br>3. Investigate if a specific application is generating unusual traffic volume. |

Backup Difference Report Recovery Model

Monitoring

Microsoft Entra Backup and Recovery is available for workforce tenants only. Microsoft Entra External ID tenants and Azure AD B2C tenants aren't supported.

Operate Microsoft Traffic

Monitoring

This section is organized in the order you should implement monitoring for Microsoft traffic:

Security Audit Events

Monitoring

View all Kerberos ticket-granting (event ID 4768) and service ticket (event ID 4769) events that used RC4 encryption in the last seven days, to identify workloads and service accounts that still rely on RC4:

Entra Service Limits Include

Monitoring

| Reports | A maximum of 1,000 rows can be viewed or downloaded in any report. Any additional data is truncated. |

Policy All Users Require Terms Of Use

Monitoring

To test your policy, try to sign in to the [Microsoft Entra admin center](https://entra.microsoft.com) using a test account. You should see a dialog that requires you to accept your terms of use.

Sla Performance

Monitoring

| --- | --- | --- | --- | --- | --- | --- |

Migrate from DirectAccess to Microsoft Entra Private Access

Monitoring

DirectAccess provides remote connectivity to internal resources but relies on IPv6 transition technologies, requires domain-joined Windows Enterprise clients, and grants full network-level access once connected. However, these architectural constraints don't meet the needs of modern hybrid and cloud-first environments.

Application Proxy Network Topology

Monitoring

Place the connector close to the target application in the customer network. This configuration minimizes step 3 in the topography diagram, because the connector and application are close.

Global Secure Access network traffic logs

Monitoring

Learn how to use Global Secure Access traffic logs (preview) to monitor connections to the service, the type of traffic, and who's connecting.

Permissions Reference

Monitoring

> | [Compliance Administrator](#compliance-administrator) | Can read and manage compliance configuration and reports in Microsoft Entra ID and Microsoft 365. | 17315797-102d-40b4-93e0-432062caca18 |

What If Tool

Monitoring

Start an evaluation by selecting **What If**. The evaluation result provides you with a report that consists of:

Create Review Difference Reports

Monitoring

1. Go to **Backup and recovery** > **Backups**. Select a backup from the list, and then select **Create difference report**.

Recover Applications

Monitoring

After you determine the cause of the changes, validate whether the secrets for applications were impacted. Find changes to application secrets in the audit log. Look for events that indicate the application secret was changed or updated.

Recover Objects

Monitoring

1. Go to **Backup and recovery** > **Difference reports**. Select a completed difference report.

Sla Performance

Monitoring

| Month | 2021 | 2022 | 2023 | 2024 | 2025 | 2026 |

Reports Data Retention

Monitoring

**No**, you can't. Azure stores up to seven days of activity data for a free version. When you switch from a free to a premium version, you can only see up to 7 days of data.

Daily Entra.News

Get daily email updates

Get a concise summary of the latest Microsoft Entra updates delivered straight to your inbox.

Loading the secure signup form…