This workflow template enforces regional access policies for sign-ins by retrieving Entra ID (ex-Azure AD) audit logs and analyzing them for compliance with designated allowed regions. If discrepancies are identified, such as a user signing in from a disallowed area, the system triggers an alert to a specified Slack channel with the sign-in details, enhancing security by enabling rapid response to potential breaches.
Use Cases
Identity and Access Management , Suspicious User Activity
Workflow Breakdown
Retrieve the Entra ID (ex-Azure AD) Audit logs for the time period
Loop over each sign-in and compare against the specific allowed regions
If a violation is found, notify the Slack channel and provide sign-in details.
Vendors
Utils, HTTP, Microsoft 365, Microsoft Teams Bot
Workflow Output
On violation, update the Slack channel