{"id":304,"date":"2025-09-16T13:40:42","date_gmt":"2025-09-16T12:40:42","guid":{"rendered":"https:\/\/cyber-resilience.mobi\/?p=304"},"modified":"2025-09-16T13:40:42","modified_gmt":"2025-09-16T12:40:42","slug":"seamless-sso","status":"publish","type":"post","link":"https:\/\/cyber-resilience.mobi\/?p=304","title":{"rendered":"Seamless SSO"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Cette requ\u00eate permet de :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Identifier les \u00e9v\u00e9nements Seamless SSO sur les 30 derniers jours.<\/li>\n\n\n\n<li>Corr\u00e9ler ces \u00e9v\u00e9nements avec les infos des devices.<\/li>\n\n\n\n<li>D\u00e9terminer si l\u2019usage de Seamless SSO est\u00a0<strong>coh\u00e9rent<\/strong>\u00a0avec le type d\u2019adh\u00e9sion du device.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ Get all device info we can find\nlet devices = (\n    DeviceInfo\n    \/\/ Search for 14 days\n    | where TimeGenerated > ago(14d)\n    \/\/ Normalize DeviceName \n    \/\/ --> if it is an IP Address we keep it\n    \/\/ --> If it is not an IP Address we only use the hostname for correlation\n    | extend DeviceName = iff(ipv4_is_private(DeviceName), DeviceName, tolower(split(DeviceName, \".\")&#91;0]))\n    \/\/ Only get interesting data\n    | distinct DeviceName, OSPlatform, OSVersion, DeviceId, OnboardingStatus, Model, JoinType\n);\nIdentityLogonEvents\n\/\/ Get the last 30 days of logon events on Domain Controllers\n| where TimeGenerated > ago(30d)\n\/\/ Search for Seamless SSO events\n| where Application == \"Active Directory\" and Protocol == \"Kerberos\"\n| where TargetDeviceName == \"AZUREADSSOACC\"\n\/\/ Save the domain name of the Domain Controller\n| extend OnPremisesDomainName = strcat(split(DestinationDeviceName, \".\")&#91;-2], \".\", split(DestinationDeviceName, \".\")&#91;-1])\n\/\/ Normalize DeviceName \n\/\/ --> if it is an IP Address we keep it\n\/\/ --> If it is not an IP Address we only use the hostname for correlation\n| extend DeviceName = iff(ipv4_is_private(DeviceName), DeviceName, tolower(split(DeviceName, \".\")&#91;0]))\n\/\/ Only use interesting data and find more info regarding the source device\n| distinct AccountUpn, OnPremisesDomainName, DeviceName\n| join kind=leftouter devices on DeviceName \n| project-away DeviceName1\n\/\/ Check if Seamless SSO usage is expected\n| extend &#91;'Seamless SSO Expected'] = case(\n    \/\/ Cases where we do not expect Seamless SSO to be used\n    JoinType == \"Hybrid Azure AD Join\" or \n    JoinType == \"AAD Joined\" or\n    JoinType == \"AAD Registered\", \"No\",\n    \/\/ Cases where we do expect Seamless SSO to be used\n    JoinType == \"Domain Joined\" or \n    (OSPlatform startswith \"Windows\" and toreal(OSVersion) &lt; 10.0) , \"Yes\", \n    \/\/ Cases that need to be verified\n    \"Unknown (to verify)\"\n)<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Cette requ\u00eate permet de :<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[18],"class_list":["post-304","post","type-post","status-publish","format-standard","hentry","category-kql-sentinel","tag-kql"],"_links":{"self":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts\/304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=304"}],"version-history":[{"count":1,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts\/304\/revisions"}],"predecessor-version":[{"id":305,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=\/wp\/v2\/posts\/304\/revisions\/305"}],"wp:attachment":[{"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyber-resilience.mobi\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}