In this article:

• Objective

• Prerequisites

• Steps to follow

• Validation and confirmation

• Tips

• Related topics and articles

Objective   

This article explains how to configure an alert in ManageEngine ADAudit Plus to notify administrators whenever a user is added to any role in Entra ID. This alert helps ensure visibility into privilege escalation, enhances security monitoring of cloud identities, and supports compliance with access control policies.

Prerequisites  

• Access to the ADAudit Plus web console is needed.

• A user account with administrator privileges or a technician account with delegated permissions to configure alerts under the cloud directory is needed.

• The Entra ID audit module must be properly configured and licensed in ADAudit Plus.

• Audit logs must be actively collected from Entra ID (i.e., ensure the audit module under the cloud directory shows a healthy sync status). 

• To receive alert notifications via email from ADAudit Plus, ensure the SMTP settings are configured under Admin > General Settings > Server Settings.

Steps to follow

1. Log in to the ADAudit Plus web console as an administrator or with a technician account with delegated permissions to create or modify alerts.

2. Navigate to the Alerts tab.

3. Click New Alert Profile in the top-right corner.

4. Enter a relevant Name and Description (e.g., Member Added to Azure AD Role).

5. Click the + symbol in the Report Profiles field.

6. From the Domain drop-down, select the configured cloud account.

7. Select the User Modified report profile. Click OK.

8. You can tailor the Alert Message to suit your specific requirements.

9. In the Advanced Configuration section, enable the Filter option, click Add Filter, and define the criteria below:

• Attribute: ACTIVITY

• Operator: contains

• Value: Add Member to Role

This will generate alerts for any role membership addition in Entra ID.

10. If you only want to be alerted about changes to a specific role, click the + icon and define the criteria below:

• Attribute: TARGET NAME

• Operator: equals

• Value: The exact name of the role (e.g., Security Administrator)

11. In the Alert Actions section, enable E-mail Notification.

12. Enter the recipient email addresses where the alert should be delivered.

13. Provide a clear, relevant subject line for the email notification.

14. Select the preferred format for the alert email, either HTML or Text.

15. Select the details you would like to include in the email:

• Alert Message

• Alert Profile Name

• Event Details

16. Enable the Throttle Notification option to combine multiple alerts into a single notification based on the defined criteria.
    Example: If multiple login failures are detected from the same user within 15 minutes, consolidate them into one alert after that time window.

17. If SMS provider settings are already configured in ADAudit Plus (under Admin > General Settings > Server Settings > SMS), enable SMS Notification for real-time updates.

18. Enable the Execute Script option to trigger a script automatically when a specific alert is generated.
    Example: Lock a user account temporarily after detecting 10 consecutive login failures from that account.

19. If a ticketing tool is integrated with ADAudit Plus (under Admin > Configuration > Ticketing System Integration), enable Configure Auto Ticketing to automatically generate tickets for alerts.

Note: You can also use the Throttle Ticket Generation option to avoid creating a ticket for every alert and to instead generate one for a group of alerts meeting certain conditions.

20. Click Save to activate the alert profile.

Validation and confirmation

1. Manually add a test user to any Entra ID role using the Entra ID portal.

2. In ADAudit Plus, navigate to the Alerts tab and expand the cloud domain under Profile Based Alerts. 

3. Select the alert profile that was created to view alerts in the ADAudit Plus console.

4. Verify that the alert appears with the correct event details.

5. Ensure the alert email is received at the specified addresses.

6. If you configured a filter for a specific role, confirm that alerts are triggered only for that role and not for others.

Tips

• Set up alerts for critical roles.

• Regularly audit alert profiles and delivery configurations to ensure they remain relevant and aligned with security policy changes.

• Use relevant names and descriptions for alert profiles (e.g., Entra ID: Member Added to Role) for easy identification and maintenance.

Related topics and articles

• How to create an alert to notify admins when a member is removed from any role