​
Event Information

  • The “Delete user” event in Azure Active Directory refers to the action of permanently removing a user account from the Azure AD tenant.
  • This event indicates that a user account has been deleted and will no longer have access to any resources or services associated with the Azure AD tenant.
  • The “Delete user” event can be useful for auditing and tracking purposes, as it allows administrators to monitor user account deletions and ensure that proper access controls are being followed.

​
Examples

  1. Unauthorized Deletion: If security is impacted with Delete user in Azure Active Directory, one example is the risk of unauthorized deletion. If a user with malicious intent gains access to the Azure Active Directory and deletes a user account, it can lead to unauthorized access to resources and data. This can result in data breaches, loss of sensitive information, and disruption of business operations.
  2. Data Loss: Another example of security impact is the potential for data loss. When a user is deleted from Azure Active Directory, their associated data, such as emails, files, and settings, may also be deleted. If this data is not properly backed up or migrated to another user, it can result in permanent data loss, impacting business continuity and potentially violating data retention policies or compliance regulations.
  3. Access Control Issues: Deleting a user in Azure Active Directory can also lead to access control issues. If a user account is deleted without proper consideration of their permissions and access rights, it can result in orphaned resources or services that are no longer managed or controlled. This can create security vulnerabilities, as unauthorized users may gain access to these resources or services, potentially leading to data breaches or unauthorized actions. It is important to ensure that access rights are properly reviewed and adjusted before deleting a user in Azure Active Directory.

​
Remediation

​
Using Console

To remediate the issue for Azure Active Directory using the Azure console, you can follow these step-by-step instructions:
  1. Enable Multi-Factor Authentication (MFA):
    • Sign in to the Azure portal (portal.azure.com) using your administrator account.
    • Navigate to the Azure Active Directory service.
    • Select “Security” from the left-hand menu.
    • Under “Manage,” click on “MFA” to access the Multi-Factor Authentication settings.
    • Enable MFA for all users or specific users/groups as per your organization’s requirements.
    • Configure the MFA settings, such as the verification method (phone call, text message, mobile app), and the number of days before users are prompted to re-authenticate.
  2. Implement Conditional Access Policies:
    • In the Azure portal, go to the Azure Active Directory service.
    • Select “Security” from the left-hand menu.
    • Under “Manage,” click on “Conditional Access” to access the Conditional Access policies.
    • Create a new policy or modify an existing one to enforce additional security controls based on your organization’s requirements.
    • Configure conditions such as user/group, location, device state, and client app.
    • Define access controls like requiring MFA, blocking access, or granting access only from trusted locations.
    • Assign the policy to the desired users/groups.
  3. Monitor and Respond to Security Alerts:
    • In the Azure portal, navigate to the Azure Active Directory service.
    • Select “Security” from the left-hand menu.
    • Under “Manage,” click on “Security alerts” to access the security alerts dashboard.
    • Review the alerts and investigate any suspicious activities or potential security threats.
    • Take appropriate actions based on the severity of the alerts, such as blocking users, resetting passwords, or escalating to the incident response team.
    • Regularly monitor the security alerts and adjust the response actions as needed to ensure the security of your Azure Active Directory environment.

​
Using CLI

To remediate Azure Active Directory issues using Azure CLI, you can use the following commands:
  1. Enable MFA for Azure AD users:
    • Command: az ad user update --id <user-id> --force-change-password-next-login true
    • Description: This command forces the user to change their password at the next login, which can help enforce Multi-Factor Authentication (MFA) for the user.
  2. Enable Conditional Access policies:
    • Command: az ad policy assignment create --policy <policy-id> --assignee <user-id>
    • Description: This command assigns a Conditional Access policy to a specific user, which allows you to control access based on conditions such as location, device, or risk level.
  3. Monitor Azure AD sign-ins:
    • Command: az monitor activity-log alert create --name <alert-name> --scopes <resource-id> --condition "category = 'SignInLogs' and level = 'Error'" --action-groups <action-group-id>
    • Description: This command creates an activity log alert that triggers when there are error-level sign-in logs in Azure AD. You can specify the resource ID, condition, and action group to customize the alert.
Please note that the commands provided are examples and may need to be modified based on your specific requirements and environment.

​
Using Python

To remediate Azure Active Directory issues using Python, you can utilize the Azure SDK for Python. Here are three examples of how you can use Python to remediate Azure Active Directory issues:
  1. Reset User Password:
    • Use the azure-identity library to authenticate with Azure Active Directory.
    • Use the azure-mgmt-graphrbac library to interact with the Azure AD Graph API.
    • Use the UserOperations class to reset the password for a specific user.
    • Here’s an example script:
    from azure.identity import DefaultAzureCredential
from azure.mgmt.graphrbac import GraphRbacManagementClient

# Authenticate with Azure AD
credential = DefaultAzureCredential()
graph_client = GraphRbacManagementClient(credential, "<your-tenant-id>")

# Reset user password
user_object_id = "<user-object-id>"
password = "<new-password>"
graph_client.users.update(user_object_id, password_profile={"password": password})
  2. Enable Multi-Factor Authentication (MFA) for a User:
    • Use the azure-identity library to authenticate with Azure Active Directory.
    • Use the azure-mgmt-graphrbac library to interact with the Azure AD Graph API.
    • Use the UserOperations class to enable MFA for a specific user.
    • Here’s an example script:
    from azure.identity import DefaultAzureCredential
from azure.mgmt.graphrbac import GraphRbacManagementClient

# Authenticate with Azure AD
credential = DefaultAzureCredential()
graph_client = GraphRbacManagementClient(credential, "<your-tenant-id>")

# Enable MFA for a user
user_object_id = "<user-object-id>"
user = graph_client.users.get(user_object_id)
user.additional_properties["strongAuthenticationMethods"] = [{"type": "microsoftAuthenticator"}]
graph_client.users.update(user_object_id, user)
  3. Add User to a Group:
    • Use the azure-identity library to authenticate with Azure Active Directory.
    • Use the azure-mgmt-graphrbac library to interact with the Azure AD Graph API.
    • Use the GroupOperations class to add a user to a specific group.
    • Here’s an example script:
    from azure.identity import DefaultAzureCredential
from azure.mgmt.graphrbac import GraphRbacManagementClient

# Authenticate with Azure AD
credential = DefaultAzureCredential()
graph_client = GraphRbacManagementClient(credential, "<your-tenant-id>")

# Add user to a group
user_object_id = "<user-object-id>"
group_object_id = "<group-object-id>"
graph_client.groups.add_member(group_object_id, user_object_id)
Please note that you need to install the required libraries (azure-identity and azure-mgmt-graphrbac) before running these scripts.