Microsoft Graph PowerShell Commands Enable Detection of “Risky” Logins
What Happened — A SANS Internet Storm Center diary entry (20 Aug 2024) details new Microsoft Graph PowerShell cmdlets that surface “risky” sign‑in events (e.g., atypical locations, impossible travel, leaked credentials). The post shows how security teams can query Azure AD risk detections in real time to surface potentially compromised accounts.
Why It Matters for Compliance & Audit Readiness
- Detecting anomalous sign‑ins directly supports SOC 2 CC6.1 (Logical Access) and CC6.2 (User Access Management) by providing continuous evidence that access is being reviewed and revoked when risk is identified.
- Automated Graph queries create immutable logs that can be harvested as audit‑ready evidence for the “Access Control Monitoring” control set.
- Leveraging native Microsoft Graph aligns with a continuous‑compliance model, reducing manual evidence‑gathering effort and strengthening the organization’s risk‑based approach to credential protection.
Who Is Affected – Enterprises that rely on Azure AD / Microsoft 365 for identity management, spanning technology, finance, healthcare, and any SaaS‑heavy environment.
Recommended Actions
- Map the Graph “risk detection” cmdlets to SOC 2 access‑control controls (CC6.1, CC6.2).
- Integrate the PowerShell scripts into your SIEM or GRC platform to capture risk events as immutable audit logs.
- Define a response playbook: when a risky sign‑in is flagged, trigger MFA enforcement, session termination, and ticket creation.
- Periodically review the collected risk data to demonstrate due‑diligence during SOC 2 audits.
Source: SANS Internet Storm Center diary
Technical Notes – The commands use the Get-MgRiskDetection and Get-MgRiskyUser Graph endpoints. They surface risk scores based on Microsoft’s internal analytics (impossible travel, leaked credentials, sign‑in from anonymous IPs). No CVEs are involved; the focus is on detection, not exploitation.