6.0 Automation & Continuous Monitoring: Foundation: Mastering Workload Identity Security in Microsoft Entra ID - An Exploratory Guide

Blog 6: Automation & Continuous Monitoring - Mastering Workload Identity Security

Throughout this series, we've journeyed from understanding workload identities and applying basic hygiene to implementing advanced premium security features like Conditional Access, Identity Protection, and Access Reviews. Our final blog focuses on ensuring these efforts are sustainable and effective in the long run through automation and continuous monitoring.

The Need for Automation and Continuous Monitoring

The landscape of workload identities is dynamic. New applications are registered, permissions change, and new threats emerge. Manual checks, while valuable, cannot scale and are prone to human error.

• Automation: Reduces manual toil, ensures consistency, and enables rapid response.

• Continuous Monitoring: Provides ongoing visibility into the state of your workload identities, highlighting new risks, non-compliance with policies, and suspicious activities.

Automating Audit Tasks with PowerShell

Many of the PowerShell audit scripts presented in previous blogs (using beta cmdlets) can be scheduled to run regularly, and their output can be directed to a logging system, email notifications, or even automated ticketing systems.

Key Areas for Automation:

1. Inventory Management (Blog 1 & 5 - CIS 1.1):

• Schedule the inventory script to run weekly/monthly.

• Compare new inventories against previous ones to detect new or unexpectedly removed service principals.

• PowerShell Example Snippet (Conceptual - for scheduled task):

  
  # Define required scopes
  $requiredScopes = @(
      "Application.Read.All",
      "ServicePrincipalEndpoint.Read.All",
      "AppRoleAssignment.ReadWrite.All",
      "Directory.Read.All"
  )
  
  # Check if already connected and if required scopes are granted
  $currentContext = Get-MgContext
  $missingScopes = @()
  
  if ($currentContext -and $currentContext.Scopes) {
      foreach ($scope in $requiredScopes) {
          if ($currentContext.Scopes -notcontains $scope) {
              $missingScopes += $scope
          }
      }
  } else {
      $missingScopes = $requiredScopes
  }
  
  # Connect with missing scopes if needed
  if ($missingScopes.Count -gt 0) {
      Write-Host "Connecting to Microsoft Graph with required scopes..."
      Connect-MgGraph -Scopes $requiredScopes
  } else {
      Write-Host "Already connected with required scopes."
  }
  
  # Define export path
  $exportFolder = "C:\AutomatedReports"
  $exportFile = "ServicePrincipalInventory_$(Get-Date -Format 'yyyyMMdd').csv"
  $exportPath = Join-Path -Path $exportFolder -ChildPath $exportFile
  
  # Ensure the folder exists
  if (-not (Test-Path -Path $exportFolder)) {
      New-Item -Path $exportFolder -ItemType Directory | Out-Null
  }
  
  # Retrieve all SPs with necessary properties for client-side filtering
  $allSPs = Get-MgBetaServicePrincipal -All -Property "Id,AppId,DisplayName,ServicePrincipalType,AppOwnerOrganizationId,SignInAudience"
  
  $myTenantIdObject = Get-MgBetaOrganization
  $myTenantIdGuid = [guid]$myTenantIdObject.Id # Corrected: Direct property access
  $microsoftTenantIdGuid = [guid]"f8cdef31-a31e-4b4a-93e4-5f571e91255a"
  
  $inventory = $allSPs | Select-Object Id, AppId, DisplayName, ServicePrincipalType, AppOwnerOrganizationId, SignInAudience, @{N="OwnerType";E={
      if ($_.AppOwnerOrganizationId -eq $microsoftTenantIdGuid) {"Microsoft Default"}
      elseif ($_.AppOwnerOrganizationId -eq $myTenantIdGuid) {"Admin-Deployed (My Org)"}
      elseif ($_.AppOwnerOrganizationId -ne $null) {"ISV/Third-Party"}
      else {"Unknown/Other"}
  }}
  
  # Export the inventory
  $inventory | Export-Csv -Path $exportPath -NoTypeInformation
  Write-Host "Inventory exported to: $exportPath"
  
  # Compare with the most recent previous inventory
  $previousFiles = Get-ChildItem -Path $exportFolder -Filter "ServicePrincipalInventory_*.csv" | Sort-Object LastWriteTime -Descending
  if ($previousFiles.Count -gt 1) {
      $previousFile = $previousFiles[1].FullName
      $previousInventory = Import-Csv -Path $previousFile
  
      # Compare inventories
      $addedSPs = Compare-Object -ReferenceObject $previousInventory -DifferenceObject $inventory -Property Id -PassThru | Where-Object { $_.SideIndicator -eq "=>" }
      $removedSPs = Compare-Object -ReferenceObject $previousInventory -DifferenceObject $inventory -Property Id -PassThru | Where-Object { $_.SideIndicator -eq "<=" }
      $changedSPs = Compare-Object -ReferenceObject $previousInventory -DifferenceObject $inventory -Property Id, AppId, DisplayName, ServicePrincipalType, AppOwnerOrganizationId, SignInAudience -PassThru | Where-Object { $_.SideIndicator -eq "==" }
  
      # Generate summary report
      $reportPath = Join-Path -Path $exportFolder -ChildPath "ServicePrincipalComparisonReport_$(Get-Date -Format 'yyyyMMdd').txt"
      $reportContent = @"
  Service Principal Inventory Comparison Report - $(Get-Date -Format 'yyyy-MM-dd')
  
  Added Service Principals:
  $($addedSPs | Format-Table -AutoSize | Out-String)
  
  Removed Service Principals:
  $($removedSPs | Format-Table -AutoSize | Out-String)
  
  Changed Service Principals:
  $($changedSPs | Format-Table -AutoSize | Out-String)
  "@
      $reportContent | Out-File -FilePath $reportPath
      Write-Host "Comparison report generated at: $reportPath"
  } else {
      Write-Host "No previous inventory file found for comparison."
  }
  

2. Credential Expiry Audit (Blog 2 & 5 - CIS 2.1):

• Schedule the credential expiry script (from Blog 2/5) to run daily/weekly.

• Send email alerts to application owners or a central IT team when credentials expire within a defined window (e.g., 30, 14, or 7 days).

• PowerShell Example Snippet (Conceptual - for alerting, assumes $expiringCredentialsReport is populated by the full script from Blog 2):

  # ($expiringCredentialsReport populated by the full script in Blog 2)
  if ($expiringCredentialsReport.Count -gt 0) { # Check if the report has data
      $body = $expiringCredentialsReport | Out-String
      # Example: Send-MailMessage -From "noreply@yourdomain.co.uk" -To "app.admins@yourdomain.co.uk" -Subject "Workload Identity Credential Expiry Alert" -Body $body -SmtpServer "smtp.yourdomain.co.uk"
      # For production, consider more robust logging or ticketing integration.
  }

3. Owner Audit (Blog 2 & 5 - CIS 2.2):

• Schedule the owner audit script (from Blog 2/5, using Get-MgBetaApplicationOwner after client-side filtering Get-MgBetaApplication) to run monthly.

• Alert on applications with no owners.

4. Inactive Service Principal Detection (Blog 2):

• Schedule scripts to query sign-in logs (via Log Analytics for extended history or recent logs via Get-MgBetaAuditLogSignIn).

• Flag service principals with no sign-in activity beyond your defined threshold (e.g., 90 days).

• Generate a report for review or initiate a deactivation/deletion workflow.

Tools for Scheduling PowerShell Scripts:

• Windows Task Scheduler: A built-in Windows tool.

• Azure Automation: A cloud-based automation service that can run PowerShell runbooks on a schedule. This is often preferred for Azure-centric tasks as it can use managed identities for authentication.

• Third-party Scheduling Tools: Various enterprise scheduling solutions.

Integrating Workload Identity Logs with Your SIEM

As detailed in Supporting Blog B, sending Microsoft Entra ID logs (including ServicePrincipalSignInLogs, AuditLogs, RiskyServicePrincipals, ServicePrincipalRiskEvents) to a Log Analytics workspace is crucial. The next step is integrating these logs with your organisation's Security Information and Event Management (SIEM) solution (e.g., Microsoft Sentinel, Splunk, QRadar).

Benefits of SIEM Integration:

• Centralised Visibility: Correlate workload identity events with other security data across your infrastructure.

• Advanced Threat Detection: Leverage the SIEM's advanced analytics, correlation rules, and machine learning to detect sophisticated attacks involving workload identities.

• Custom Alerting and Dashboards: Create tailored alerts and visualisations for workload identity risks.

• Incident Response: Streamline incident response by having all relevant logs in one place.

How to Integrate:

• Microsoft Sentinel: Has built-in data connectors for Microsoft Entra ID and Log Analytics.

  

• Other SIEMs: Most SIEMs provide methods to ingest Azure Monitor/Log Analytics logs, often via the Azure Event Hubs or direct API connectors.

Key Log Data to Monitor in SIEM for Workload Identities:

• Suspicious Sign-ins: High volume of failures, sign-ins from unexpected locations or with unusual properties.

• Credential Changes: Frequent or unauthorised changes to service principal secrets or certificates.

• Permission Escalations: Unexpected grants of high-privilege API permissions or directory roles.

• Risk Detections: Alerts from Identity Protection for risky workload identities.

• Anomalous Activity: Deviations from normal behaviour patterns.

Best Practices for Ongoing Maintenance and Lifecycle Management

Securing workload identities is not a one-time project; it's an ongoing process.

1. Regularly Review This Guide: Revisit the principles and practices outlined in this blog series.

2. Stay Updated: Microsoft regularly releases new features and enhances existing ones. Keep an eye on Microsoft Entra announcements.

3. Periodic Deep Dives: Beyond automated checks, schedule periodic (e.g., quarterly, bi-annually) deep-dive reviews of:

• High-privilege service principals.

• Service principals with access to sensitive data.

• Conditional Access policies and Identity Protection configurations.

• Access Review results.

4. Onboarding/Offboarding Processes for Applications:

• Onboarding: When a new application/service principal is created, ensure it follows security best practices from day one (least privilege, assigned owner, appropriate credential type, consideration for CA policies).

• Offboarding: When an application is decommissioned, ensure its service principal and all associated credentials and permissions are promptly and securely removed.

5. Training and Awareness: Ensure your application developers and IT staff know best practices for workload identity security.

Exploring Advanced Scenarios and Future Directions

The field of identity security is constantly evolving. Here are a few advanced areas to consider:

• Workload Identity Federation: For specific scenarios (e.g., GitHub Actions, Kubernetes workloads, workloads in other clouds like AWS or GCP), Workload Identity Federation allows your software workloads to exchange a token from an external Identity Provider (IdP) for a Microsoft Entra access token, without needing to manage secrets in Entra ID. This is a highly recommended approach for supported scenarios as it eliminates secret management for those workloads.

• Continuous Access Evaluation (CAE) for Workload Identities: CAE allows for near real-time enforcement of certain events (like a service principal being disabled or a CA policy change) rather than waiting for token expiry. Support for workload identities is evolving.

• Application Governance in Microsoft Defender for Cloud Apps: Provides deeper insights into app activities, data usage, and compliance for OAuth-enabled apps, which can include those represented by your service principals.

Conclusion of the Series

Securing your Microsoft Entra workload identities is a critical journey that significantly enhances your organisation's overall cybersecurity posture. By starting with foundational hygiene, progressively implementing premium protection and governance features, and embedding automation and continuous monitoring into your operations, you can effectively manage the risks associated with these powerful non-human identities.

We hope this blog series has provided you with valuable, actionable guidance. Remember that security is a continuous assessment, improvement, and adaptation process. The CIS-aligned controls discussed are exploratory; we will update this series if and when official CIS guidance for workload identities becomes available.

Thank you for following along!

Summary Table: CIS-Aligned Recommendations & Licence Requirements

This table summarises the proposed CIS-aligned controls discussed in Blog 5. It indicates the Microsoft Entra ID licence tier generally required to implement the core aspects of the audit and remediation. These are exploratory recommendations, and there are no official CIS controls for this scope yet.

Note on "Premium Tier": In this table, "Premium Tier" refers to Microsoft Entra Workload Identities Premium unless otherwise stated. "P2/IDG" refers to Microsoft Entra ID P2 or Microsoft Entra ID Governance licences, which are often required for features like Privileged Identity Management (PIM) and reviewers in Access Reviews, in addition to Workload Identities Premium for the workload identity itself being part of the review.