Request for Clarification: "Azure CLI" Sign-in Log Entry

Azure CLI sign-ins are normal and expected whenever a user or script authenticates to Azure using the az command-line tool against Microsoft Entra ID. In Microsoft Entra sign-in logs, these appear as interactive or non-interactive sign-ins where the client application is the Azure CLI (or its underlying service principal), and they are used for:

• Administrators or developers running az login for management tasks
• Automation scripts or tools that call Azure CLI for deployments or configuration
• Troubleshooting and operational tasks that require command-line access

Because Microsoft Entra logs all sign-ins into an Azure tenant for compliance purposes, Azure CLI-based authentications are captured like any other client and can be used to monitor for unusual or risky activity.

To distinguish legitimate Azure CLI activity from potentially suspicious or attacker-generated sign-ins, use the same “unusual sign-in” patterns and risk indicators described for user accounts and privileged accounts:

1. Failed authentications and spikes in failures
   • Look for patterns of many failed authentications from Azure CLI (for example, repeated bad passwords or token failures) rather than occasional user mistakes.
   • Monitor for increased failed authentications where the failure total for a day is significantly higher (for example, >10%) than the same day in the previous week.
   • These patterns can indicate password spray or brute-force attempts.
2. Interrupts and Conditional Access failures
   • In sign-in logs, an “Interrupted” status with Conditional Access failures can indicate that a control (such as MFA or device compliance) is being enforced but not satisfied.
   • For example, if authentication details show that the password is correct but strong authentication (MFA) is required and not completed, this can indicate a compromised password where the attacker cannot complete MFA.
3. Smart lockout and account lockouts
   • Monitor for accounts that are locked out due to repeated failed sign-ins from Azure CLI.
   • Smart lockout differentiates familiar vs. unfamiliar locations; repeated lockouts from unfamiliar locations are more suspicious.
4. IP address patterns
   • Examine the IP addresses associated with Azure CLI sign-ins:
     • Normal: a small set of known corporate egress IPs or VPN endpoints.
     • Suspicious: many different IPs, especially from unexpected networks or cloud providers, combined with failed sign-ins.
   • Monitor for a pattern of many failed authentications from multiple IP addresses; this can indicate intrusion attempts.
5. Geographical locations and “impossible travel”
   • Check whether Azure CLI sign-ins originate from countries/regions where users normally operate.
   • Sign-ins from geographically distant locations in less time than it would take to travel can indicate account abuse (keeping in mind VPNs can cause false positives).
6. Time-of-day anomalies
   • Monitor Azure CLI sign-ins occurring at times or days when the organization does not normally operate (for example, outside normal business hours for a given region).
   • Successful sign-ins at unusual times can be an early indicator of misuse.
7. Privileged accounts using Azure CLI
   • For privileged accounts (administrators, break-glass accounts), monitor all Azure CLI sign-in activity closely:
     • Sign-in failures with specific error codes (for example, bad passwords) should be treated as high risk.
     • Conditional Access failures (for example, blocked by policy) can indicate an attacker probing privileged accounts via CLI.
8. Use Microsoft Entra ID Protection and risk detections
   • Use Microsoft Entra ID Protection and sign-in risk detections to help identify risky Azure CLI sign-ins:
     • New country/region sign-in risk detection
     • Activity from anonymous IP address
     • Microsoft Entra threat intelligence-based risk detections
   • These detections can be monitored via Microsoft Entra risk detection logs and integrated with SIEM solutions for alerting.
9. Baseline “normal” Azure CLI usage
   • Define what normal Azure CLI usage looks like in the environment:
     • Typical users and groups who use CLI
     • Expected IP ranges and countries/regions
     • Typical frequency and time windows for CLI sign-ins
   • Use this baseline to detect deviations, such as:
     • New users suddenly using Azure CLI
     • CLI sign-ins from unexpected locations or networks
     • Sudden spikes in CLI sign-ins for a given account
10. Forwarding to monitoring tools
    • Replicate Microsoft Entra sign-in logs to Azure Monitor or a SIEM and build alerts specifically for Azure CLI client application entries that match the unusual sign-in patterns above (failed spikes, new locations, anonymous IPs, off-hours activity, etc.).

In summary, Azure CLI appearing as the client application in Microsoft Entra sign-in logs is expected for normal operations. Legitimacy should be evaluated by correlating the CLI sign-ins with known users, devices, IPs, locations, and business patterns, and by using Microsoft Entra ID Protection and sign-in logs to detect unusual or risky sign-in characteristics.

References:

• Learn about the sign-in log activity details
• What are Microsoft Entra sign-in logs?
• Microsoft Entra security operations for user accounts
• Security operations for privileged accounts in Microsoft Entra ID