WithSecure Elements

Identity Security for Entra

ID

Onboarding Guide

Contents

Chapter 1: Introduction........................................................................3

1.1 Deployed infrastructure overview.................................................................................................4

1.2 Prerequisites................................................................................................................................6

2.3.2 Diagnostic settings validation...........................................................................................11

2.4 Connecting Azure to Elements Cloud.........................................................................................12

2.5 Finishing the onboarding session...............................................................................................12

Chapter 3: Ongoing management......................................................14

3.1 When to rerun the script..............................................................................................................15

3.2 When a new tenant is created.....................................................................................................15

3.3 Reaching EventHub capacity.....................................................................................................15

3.4 Regular release of the script.......................................................................................................15

Appendix A: Deleting the deployed resources..................................16

Appendix B: Troubleshooting.............................................................18

This document outlines the configuration that is required to provide

access to WithSecure

Azure Tenant.

WithSecure

module that is designed for organizations that use Entra ID for identity

The diagram illustrates the effects of the WithSecure Entra ID configuration script that is used during the

onboarding process.

The process creates, configures, and deploys the following infrastructure:

• A resource group is created in the target tenant that contains all the resources deployed by the

• A Standard Tier Event Hub is deployed. The Event Hub is configured to retain telemetry events for 24

• An email alert from Microsoft to inform you when the Event Hub is not capable of handling the load if

that is exclusive to Azure Active Directory Premium P1 or P2 licenses, which are part of the E3 and E5

plans, respectively.

The following table describes the use of the key log sources that are collected as part of the Entra ID module.

DescriptionLog Categories

Required to monitor changes to applications, users,

and tenant configuration changes. For example,

changes in permissions of applications registrations,

and new conditional access policy created/modified.

Audit logs

Contains authentication and authorization events

for the tenant. For example, sign-in events and

Sign in logs

principals to achieve their goals.

Contains information relating to the interactions of

applications, services or systems using managed

identities. Monitoring managed identities can detect

authorized access made by attackers.

Managed Identity Sign In Logs

Provides information about "risky users” and

associated events deemed risky by M365 Defender.

For example, suspicious logons, and malformed or

suspicious token provided.

Risky Users

User Risk Events

provide detection coverage.

For multiple tenants, follow the steps outlined in this guide for each tenant. Use a unique customerID to

create an Event Hub in each tenant. WithSecure requires a connection string for each tenant’s event hub.

For example, you have to provide 3 unique connection strings for 3 tenants.

Note: This document refers to Azure documentation in many places to avoid duplicating content.

Associated Microsoft Costs

The event hub configuration that is deployed uses Standard Tier Event Hubs. The montly cost is based on

the number of Throughput Units (TU). The number of TUs depends on the load. To manage incoming data

efficiently, the Event Hub uses the Auto-Inflate feature, which is set to automatically increase the capacity

as needed, up to a maximum of 40 Throughput Units (TUs). Initially, the Event Hub is deployed with the

data, the monthly event volume ranges from 6 million to 300 million events. To illustrate, WithSecure’s

monthly expenditure for its Event Hub infrastructure is approximately $15.

1.2 Prerequisites

The following prerequisites must be met before configuration starts.

• You must be able to sign in as a Global Administrator on the Azure account to run the script in Azure

• You must have your tenant ID, subscription ID, and deployment location known and ready before you

• The tenant must have at least one Azure Management Group. To set up an Azure Management Group,

This chapter describes the steps to be completed to commence the

collection of Azure log data by WithSecure

.

Elements Security Center

1. In WithSecure Elements Security Center, go to Environment > Cloud.

2. Select Add Azure tenant.

3. Enter the following information in the Tenant information page.

Security Center.

4. Under Security capabilities, select Identity Security.

5. Select Add.

6. Enter the following information in the Connection details page.

Follow these instructions to remove the deployed resources.

This should be done in any of the following cases:

• There were some issues in the deployment process and the

deployment should be started over, or

• you want to opt out of the service and remove the monitoring

resources.

To delete the resources, execute the following command from inside

the withsecure directory: ./cleanup.ps1

Note: Currently, you cannot remove deleted resources from

Here you can find information that can help you solve your technical

issues.

completes: Follow the steps in Deploying resources.

• If deployment fails with an error indicating that the subscription is

not registered to use namespace Microsoft.PolicyInsights, do the

following:

1. Go to this subscription page and click on Resource Providers.

2. Click the Provider Microsoft.PolicyInsights and then Register

or Re-register.

3. Once the registration completed, restart the process by running

the ./deploy.ps1 script.

1. In WithSecure Elements Security Center, go to Environment > Cloud.

2. Review the Identity Security status for each tenant that is displayed in the list.