Set up comprehensive monitoring and alerting for account recovery activities to detect potential security incidents and ensure compliance.
Configure Azure Monitor alerts for recovery events:
{
"name": "Account Recovery Alert",
"description": "Alert on account recovery using Face Check",
"severity": 2,
"enabled": true,
"scopes": ["/subscriptions/your-subscription-id"],
"condition": {
"allOf": [
{
"field": "category",
"equals": "SignInLogs"
},
{
"field": "operationName",
"equals": "Account Recovery"
},
{
"field": "properties.authenticationDetails",
"contains": "Identity Verification"
}
]
},
"actions": {
"actionGroups": ["/subscriptions/your-subscription-id/resourceGroups/rg-security/providers/microsoft.insights/actionGroups/ag-security-team"]
}
}
Create a custom KQL query for detailed recovery analytics:
// Account Recovery Analytics Query
SigninLogs
| where TimeGenerated >= ago(30d)
| where AuthenticationDetails has "Identity Verification"
| extend RecoveryMethod = tostring(parse_json(AuthenticationDetails)[0].authenticationMethod)
| extend IDVProvider = tostring(parse_json(AuthenticationDetails)[0].authenticationStepRequirement)
| project TimeGenerated, UserPrincipalName, IPAddress, Location, RecoveryMethod, IDVProvider, ResultType, ResultDescription
| where ResultType == 0 // Successful recoveries
| summarize RecoveryCount = count(),
UniqueUsers = dcount(UserPrincipalName),
SuccessRate = countif(ResultType == 0) * 100.0 / count()
by bin(TimeGenerated, 1d)
| order by TimeGenerated desc
Set up automated compliance reporting:
# PowerShell script for weekly recovery report
$startDate = (Get-Date).AddDays(-7)
$endDate = Get-Date
$recoveryReport = Get-MgAuditLogSignIn -Filter "createdDateTime ge $($startDate.ToString('yyyy-MM-ddTHH:mm:ssZ')) and authenticationDetails/any(x:x/authenticationMethod eq 'Identity Verification')" -All
$report = $recoveryReport | Group-Object {$_.CreatedDateTime.Date} | ForEach-Object {
[PSCustomObject]@{
Date = $_.Name
TotalRecoveries = $_.Count
SuccessfulRecoveries = ($_.Group | Where-Object {$_.Status.ErrorCode -eq 0}).Count
FailedRecoveries = ($_.Group | Where-Object {$_.Status.ErrorCode -ne 0}).Count
UniqueUsers = ($_.Group | Select-Object -Unique UserPrincipalName).Count
}
}
$report | Export-Csv "AccountRecoveryReport_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Pro tip: Set up a dedicated Log Analytics workspace for security events and configure data retention based on your compliance requirements. Most organizations need 90+ days for security incident investigation.
Verification: Trigger a test recovery and confirm that alerts fire correctly and the event appears in your monitoring dashboard within 5 minutes. Verify that the KQL query returns accurate recovery statistics.
