#Typo in email address microsoft account how to

See, Azure AD/AzureADAssessment and confirm validity.Script to list all delegated permissions and application permissions in Azure AD scopes for service account.See, Get-AzureADServicePrincipalOAuth2PermissionGrant.Regularly review service account permissions and accessed scopes to see if they can be reduced or eliminated. Use the SIEM tool to build alerts and dashboards. We recommend you export Azure AD sign-in logs, and then import them into a security information and event management (SIEM) tool, such as Microsoft Sentinel. Changes in sign-in service account patterns.Service accounts not signed in to the tenant.Look for the following details in sign-in logs. Use the following screenshot to see service principal sign-ins. Azure AD Sign-In Logs in the Azure portal.Use one of the following monitoring methods: Collect and monitor service account sign-ins Monitor your service accounts to ensure usage patterns are correct, and that the service account is used. The following sections cover how you monitor, review permissions, determine continued account usage, and ultimately deprovision the account. Build a lifecycle processĪ service account lifecycle starts with planning, and ends with permanent deletion. If you can't use a service principal, then use an Azure AD user account. If you can't use a managed identity, use a service principal.

Create an Azure Active Directory application and service principal that can access resources.

#Typo in email address microsoft account how to

How to use managed identities for App Service and Azure Functions.

Ensure reviews occur prior to account expirationĪfter you understand the purpose, scope, and permissions, create your service account, use the instructions in the following articles.

Schedule periodic reviews of service account usage and purpose.

Limit service account credentials (client secret, certificate) to an anticipated usage period.

Ensure you trust the application developer, or API, with the requested access.

If an account requests, evaluate if it needs.

Confirm the scopes service accounts request for resources.

In the application context, no one is signed in.

Service principals and managed identities can use OAuth 2.0 scopes in a delegated context impersonating a signed-on user, or as service account in the application context.

See, Introduction to permissions and consent to limit the functionality a service account can access on a resource.

Get-AzureADDirectoryRoleMember, and filter for objectType 'Service Principal', or use Get-AzureADServicePrincipal | %

Don't include service accounts as members of any groups with elevated permissions.

Create and assign a custom role in Azure Active Directory.

The service principal is assigned a privileged role.

See, oAuth2PermissionGrant resource type.

Don't assign built-in roles to service accounts.

We recommend the following practices for service account privileges. If a service account needs high-level permissions, for example a Global Administrator, evaluate why and try to reduce permissions. Grant the service account permissions needed to perform tasks, and no more. Set an expiration date for credentials that prevents them from rolling over automatically.Ĭreate a naming convention for service accounts to search, sort, and filter them Use this measurement to schedule communications to the owner, disable, and then delete the accounts. Document what happens if a review is performed after the scheduled review period. The cadence of service account reviews, by the owner Use the information to narrow the scope of permissions and determine access to information Risk and business effect, if the account is compromised Link to the accessed resources, and scripts in which the service account is usedĭocument the resource and script owners to communicate the effects of change Avoid creating multi-use service accounts.ĭocument the resources it accesses and permissions for those resources Map the service account to a service, application, or script. Issue mitigation is done by the owner, or by request to an IT team. Grant the owner permissions to monitor the account and implement a way to mitigate issues. User or group accountable for managing and monitoring the service account We recommend collecting the following data and tracking it in your centralized Configuration Management Database (CMDB). Use the information to monitor and govern the account. Learn more: What is Conditional Access? Plan your service accountīefore creating a service account, or registering an application, document the service account key information. Instead, we recommend managed identities, or service principals, and the use of Conditional Access. This includes on-premises service accounts synced to Azure AD, because they aren't converted to service principals. We do not recommend user accounts as service accounts because they are less secure.