topic Re: User-ID with integrated agent and Azure AD in General Topics

User-ID with integrated agent and Azure AD

Ben-Price — Thu, 24 Mar 2022 06:29:57 GMT

Hi All,

Can the integrated User-ID agent of an on-prem firewall monitor Azure AD for user-to-IP address mapping information?

Many thanks

Re: User-ID with integrated agent and Azure AD

Ben-Price — Thu, 24 Mar 2022 22:47:57 GMT

@BPry Do you know if the above is possible?

Re: User-ID with integrated agent and Azure AD

BPry — Fri, 25 Mar 2022 00:17:20 GMT

Assuming that you aren't talking about a hybrid deployment, there isn't a built-in method of doing this. You'd need to use an external script to pull Azure AD events and use that information to feed in User-ID information through syslog or the API. There's not a native way to do this as far as I'm aware.

I'd actually recommend looking into using user certificates and GlobalProtect for user-id to get user information instead of pulling it through the script if you can. It'll be less prone to issues since Azure's API isn't always the most stable thing.