使用 Azure Monitor 监视 Azure AD B2CMonitor Azure AD B2C with Azure Monitor

使用 Azure Monitor 将 Azure Active Directory B2C (Azure AD B2C) 登录日志路由到不同的监视解决方案。Use Azure Monitor to route Azure Active Directory B2C (Azure AD B2C) sign-in logs to different monitoring solutions. 然后,可以保留日志供长期使用,或者将其与第三方安全信息和事件管理 (SIEM) 工具集成,以获取有关环境的见解。You can retain the logs for long-term use or integrate with third-party security information and event management (SIEM) tools to gain insights into your environment.

可将日志事件路由到:You can route log events to:

Azure Monitor

先决条件Prerequisites

若要完成本文中的步骤,请使用 Azure PowerShell 模块部署 Azure 资源管理器模板。To complete the steps in this article, you deploy an Azure Resource Manager template by using the Azure PowerShell module.

委托的资源管理Delegated resource management

Azure AD B2C 使用 Azure Active Directory 监视Azure AD B2C leverages Azure Active Directory monitoring.

授权 Azure AD B2C 目录(服务提供商)中的某个用户或组在包含你的 Azure 订阅(客户)的租户中配置 Azure Monitor 实例。You authorize a user or group in your Azure AD B2C directory (the Service Provider) to configure the Azure Monitor instance within the tenant that contains your Azure subscription (the Customer). 若要创建授权,请将 Azure 资源管理器模板部署到包含该订阅的 Azure AD 租户。To create the authorization, you deploy an Azure Resource Manager template to your Azure AD tenant containing the subscription. 以下部分将引导你完成该过程。The following sections walk you through the process.

创建或选择资源组Create or choose resource group

此资源组包含要从 Azure Monitor 接收数据的目标 Azure 存储帐户、事件中心或 Log Analytics 工作区。This is the resource group containing the destination Azure storage account, event hub, or Log Analytics workspace to receive data from Azure Monitor. 部署 Azure 资源管理器模板时请指定资源组名称。You specify the resource group name when you deploy the Azure Resource Manager template.

创建资源组,或者在包含你的 Azure 订阅的 Azure Active Directory (Azure AD) 租户(不是包含你的 Azure AD B2C 租户的目录)中选择现有的资源组。Create a resource group or choose an existing one in the Azure Active Directory (Azure AD) tenant that contains your Azure subscription, not the directory that contains your Azure AD B2C tenant.

此示例使用“中国东部”区域中名为 azure-ad-b2c-monitor 的资源组。This example uses a resource group named azure-ad-b2c-monitor in the China East region.

委托资源管理Delegate resource management

接下来收集以下信息:Next, gather the following information:

Azure AD B2C 目录的“目录 ID”(也称为租户 ID)。Directory ID of your Azure AD B2C directory (also known as the tenant ID).

  1. 以具有“用户管理员”角色(或更高)的用户身份登录到 Azure 门户Sign in to the Azure portal as a user with the User administrator role (or higher).
  2. 在门户工具栏中选择“目录 + 订阅”图标,然后选择包含 Azure AD B2C 租户的目录。Select the Directory + Subscription icon in the portal toolbar, and then select the directory that contains your Azure AD B2C tenant.
  3. 依次选择“Azure Active Directory”、“属性”。 Select Azure Active Directory, select Properties.
  4. 记下“目录 ID”。Record the Directory ID.

要向其授予对前面在包含订阅的目录中创建的资源组的“参与者”权限的 Azure AD B2C 组或用户的对象 IDObject ID of the Azure AD B2C group or user you want to give Contributor permission to the resource group you created earlier in the directory containing your subscription.

为了简化管理,建议为每个角色使用 Azure AD 用户组,这使你能够向组添加或删除单个用户,而不是直接向此用户分配权限。To make management easier, we recommend using Azure AD user groups for each role, allowing you to add or remove individual users to the group rather than assigning permissions directly to that user. 在本演练中,你将添加一个用户。In this walkthrough, you add a user.

  1. 在 Azure 门户中仍选择了“Azure Active Directory”的情况下,选择“用户”,然后选择一个用户。 With Azure Active Directory still selected in the Azure portal, select Users, and then select a user.
  2. 请记下该用户的“对象 ID”。Record the user's Object ID.

创建 Azure 资源管理器模板Create an Azure Resource Manager template

若要加入 Azure AD 租户(客户),请使用以下信息为套餐创建 Azure 资源管理器模板。To onboard your Azure AD tenant (the Customer), create an Azure Resource Manager template for your offer with the following information. 在 Azure 门户的“服务提供商”页中查看套餐详细信息时,可以看到 mspOfferNamemspOfferDescription 值。The mspOfferName and mspOfferDescription values are visible when you view offer details in the Service providers page of the Azure portal.

字段Field 定义Definition
mspOfferName 描述此定义的名称。A name describing this definition. 例如“Azure AD B2C 托管服务”。For example, Azure AD B2C Managed Services. 此值将作为产品/服务的标题显示给客户。This value is displayed to the customer as the title of the offer.
mspOfferDescription 套餐的简短说明。A brief description of your offer. 例如,“在 Azure AD B2C 中启用 Azure Monitor”。For example, Enables Azure Monitor in Azure AD B2C.
rgName 前面在 Azure AD 租户中创建的资源组的名称。The name of the resource group you create earlier in your Azure AD tenant. 例如 azure-ad-b2c-monitorFor example, azure-ad-b2c-monitor.
managedByTenantId Azure AD B2C 租户的“目录 ID”(也称为租户 ID)。The Directory ID of your Azure AD B2C tenant (also known as the tenant ID).
authorizations.value.principalId 有权访问此 Azure 订阅中的资源的 B2C 组或用户的“对象 ID”。The Object ID of the B2C group or user that will have access to resources in this Azure subscription. 对于本演练,请指定前面记下的用户对象 ID。For this walkthrough, specify the user's Object ID that you recorded earlier.

下载 Azure 资源管理器模板和参数文件:Download the Azure Resource Manager template and parameter files:

接下来,请使用前面记下的值更新参数文件。Next, update the parameters file with the values you recorded earlier. 以下 JSON 代码片段演示了 Azure 资源管理器模板参数文件的示例。The following JSON snippet shows an example of an Azure Resource Manager template parameters file. 对于 authorizations.value.roleDefinitionId,请使用“参与者”角色的内置角色b24988ac-6180-42a0-ab88-20f7382dd24cFor authorizations.value.roleDefinitionId, use the built-in role value for the Contributor role, b24988ac-6180-42a0-ab88-20f7382dd24c.

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "mspOfferName": {
            "value": "Azure AD B2C Managed Services"
        },
        "mspOfferDescription": {
            "value": "Enables Azure Monitor in Azure AD B2C"
        },
        "rgName": {
            "value": "azure-ad-b2c-monitor"
        },
        "managedByTenantId": {
            "value": "<Replace with DIRECTORY ID of Azure AD B2C tenant (tenant ID)>"
        },
        "authorizations": {
            "value": [
                {
                    "principalId": "<Replace with user's OBJECT ID>",
                    "principalIdDisplayName": "Azure AD B2C tenant administrator",
                    "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c"
                }
            ]
        }
    }
}

部署 Azure 资源管理器模板Deploy the Azure Resource Manager templates

更新参数文件后,将 Azure 资源管理器模板作为订阅级部署部署到 Azure 租户中。Once you've updated your parameters file, deploy the Azure Resource Manager template into the Azure tenant as a subscription-level deployment. 由于这是订阅级部署,因此无法在 Azure 门户中启动。Because this is a subscription-level deployment, it cannot be initiated in the Azure portal. 可以使用 Azure PowerShell 模块或 Azure CLI 进行部署。You can deploy by using the Azure PowerShell module or the Azure CLI. 下面演示了 Azure PowerShell 方法。The Azure PowerShell method is shown below.

使用 Connect-AzAccount 登录到包含你的订阅的目录。Sign in to the directory containing your subscription by using Connect-AzAccount. 使用 -tenant 标志来强制对正确的目录进行身份验证。Use the -tenant flag to force authentication to the correct directory.

Connect-AzAccount -Environment AzureChinaCloud -tenant contoso.partner.onmschina.cn

使用 Get-AzSubscription cmdlet 列出 Azure AD 租户下的、可由当前帐户访问的订阅。Use the Get-AzSubscription cmdlet to list the subscriptions that the current account can access under the Azure AD tenant. 记下要投影到 Azure AD B2C 租户的订阅的 ID。Record the ID of the subscription you want to project into your Azure AD B2C tenant.

Get-AzSubscription

接下来,切换至要投影到 Azure AD B2C 租户的订阅:Next, switch to the subscription you want to project into the Azure AD B2C tenant:

Select-AzSubscription <subscription ID>

最后,部署前面下载并更新的 Azure 资源管理器模板和参数文件。Finally, deploy the Azure Resource Manager template and parameter files you downloaded and updated earlier. 请相应地替换 LocationTemplateFileTemplateParameterFile 值。Replace the Location, TemplateFile, and TemplateParameterFile values accordingly.

New-AzDeployment -Name "AzureADB2C" `
                 -Location "chinaeast" `
                 -TemplateFile "C:\Users\azureuser\Documents\rgDelegatedResourceManagement.json" `
                 -TemplateParameterFile "C:\Users\azureuser\Documents\rgDelegatedResourceManagement.parameters.json" `
                 -Verbose

成功部署模板后,会生成如下所示的输出(为简洁起见,输出已被截断):Successful deployment of the template produces output similar to the following (output truncated for brevity):

PS /usr/csuser/clouddrive> New-AzDeployment -Name "AzureADB2C" `
>>                  -Location "chinaeast" `
>>                  -TemplateFile "rgDelegatedResourceManagement.json" `
>>                  -TemplateParameterFile "rgDelegatedResourceManagement.parameters.json" `
>>                  -Verbose
WARNING: Breaking changes in the cmdlet 'New-AzDeployment' :
WARNING:  - The cmdlet 'New-AzSubscriptionDeployment' is replacing this cmdlet.


WARNING: NOTE : Go to https://aka.ms/azps-changewarnings for steps to suppress this breaking change warning, and other information on breaking changes in Azure PowerShell.
VERBOSE: 7:25:14 PM - Template is valid.
VERBOSE: 7:25:15 PM - Create template deployment 'AzureADB2C'
VERBOSE: 7:25:15 PM - Checking deployment status in 5 seconds
VERBOSE: 7:25:42 PM - Resource Microsoft.ManagedServices/registrationDefinitions '44444444-4444-4444-4444-444444444444' provisioning status is succeeded
VERBOSE: 7:25:48 PM - Checking deployment status in 5 seconds
VERBOSE: 7:25:53 PM - Resource Microsoft.Resources/deployments 'rgAssignment' provisioning status is running
VERBOSE: 7:25:53 PM - Checking deployment status in 5 seconds
VERBOSE: 7:25:59 PM - Resource Microsoft.ManagedServices/registrationAssignments '11111111-1111-1111-1111-111111111111' provisioning status is running
VERBOSE: 7:26:17 PM - Checking deployment status in 5 seconds
VERBOSE: 7:26:23 PM - Resource Microsoft.ManagedServices/registrationAssignments '11111111-1111-1111-1111-111111111111' provisioning status is succeeded
VERBOSE: 7:26:23 PM - Checking deployment status in 5 seconds
VERBOSE: 7:26:29 PM - Resource Microsoft.Resources/deployments 'rgAssignment' provisioning status is succeeded

DeploymentName          : AzureADB2C
Location                : chinaeast
ProvisioningState       : Succeeded
Timestamp               : 1/31/20 7:26:24 PM
Mode                    : Incremental
TemplateLink            :
Parameters              :
                          Name                   Type                       Value
                          =====================  =========================  ==========
                          mspOfferName           String                     Azure AD B2C Managed Services
                          mspOfferDescription    String                     Enables Azure Monitor in Azure AD B2C
...

部署模板后,可能需要花费几分钟时间来完成资源投影。After you deploy the template, it can take a few minutes for the resource projection to complete. 在转到下一部分选择订阅之前,可能需要等待几分钟(通常不超过 5 分钟)。You may need to wait a few minutes (typically no more than five) before moving on to the next section to select the subscription.

选择订阅Select your subscription

部署模板并等待几分钟让资源投影完成之后,请通过以下步骤将订阅关联到 Azure AD B2C 目录。Once you've deployed the template and have waited a few minutes for the resource projection to complete, associate your subscription to your Azure AD B2C directory with the following steps.

  1. 如果当前已在 Azure 门户中登录,请注销Sign out of the Azure portal if you're currently signed in. 此步骤以及下一步骤的目的是在门户会话中刷新你的凭据。This and the following step are done to refresh your credentials in the portal session.

  2. 使用 Azure AD B2C 管理帐户登录到 Azure 门户Sign in to the Azure portal with your Azure AD B2C administrative account.

  3. 在门户工具栏中选择“目录 + 订阅”图标。Select the Directory + Subscription icon in the portal toolbar.

  4. 选择包含订阅的目录。Select the directory that contains your subscription.

    切换目录

  5. 确认是否选择了正确的目录和订阅。Verify that you've selected the correct directory and subscription. 在此示例中,已选择所有目录和订阅。In this example, all directories and subscriptions are selected.

    在目录和订阅筛选器中选择了所有目录

配置诊断设置Configure diagnostic settings

诊断设置定义要将资源的日志和指标发送到的位置。Diagnostic settings define where logs and metrics for a resource should be sent. 可能的目标为:Possible destinations are:

如果尚未这样做,请在 Azure 资源管理器模板中指定的资源组内创建所选目标类型的实例。If you haven't already, create an instance of your chosen destination type in the resource group you specified in the Azure Resource Manager template.

创建诊断设置Create diagnostic settings

你已准备好在 Azure 门户中创建诊断设置You're ready to Create diagnostic settings in the Azure portal.

为 Azure AD B2C 活动日志配置监视设置:To configure monitoring settings for Azure AD B2C activity logs:

  1. 登录到 Azure 门户Sign in to the Azure portal.

  2. 在门户工具栏中选择“目录 + 订阅”图标,然后选择包含 Azure AD B2C 租户的目录。Select the Directory + Subscription icon in the portal toolbar, and then select the directory that contains your Azure AD B2C tenant.

  3. 选择“Azure Active Directory”Select Azure Active Directory

  4. 在“监视”下,选择“诊断设置” 。Under Monitoring, select Diagnostic settings.

  5. 如果资源上有现有的设置,则会看到已配置的设置列表。If there are existing settings on the resource, you will see a list of settings already configured. 如果要添加新设置,请选择“添加诊断设置”;如果要编辑现有设置,请选择“编辑”设置 。Either select Add diagnostic setting to add a new setting, or Edit setting to edit an existing one. 每个设置最多只能包含一个目标类型。Each setting can have no more than one of each of the destination types..

    Azure 门户中的诊断设置窗格

  6. 为设置指定名称(如果未指定)。Give your setting a name if it doesn't already have one.

  7. 选中要将日志发送到的每个目标对应的框。Check the box for each destination to send the logs. 选择“配置”并根据下表中所述指定其设置。Select Configure to specify their settings as described in the following table.

    设置Setting 说明Description
    存档到存储帐户Archive to a storage account 存储帐户的名称。Name of storage account.
    流式传输到事件中心Stream to an event hub 要在其中创建事件中心的命名空间(如果这是首次流式传输日志)或要将日志流式传输到的命名空间(如果已有资源将该日志类别流式传输到此命名空间)。The namespace where the event hub is created (if this is your first time streaming logs) or streamed to (if there are already resources that are streaming that log category to this namespace).
    发送到 Log AnalyticsSend to Log Analytics 工作区的名称。Name of workspace.
  8. 选择“AuditLogs”和“SignInLogs” 。Select AuditLogs and SignInLogs.

  9. 选择“保存” 。Select Save.

后续步骤Next steps

有关在 Azure Monitor 中添加和配置诊断设置的详细信息,请参阅教程:从 Azure 资源收集和分析资源日志For more information about adding and configuring diagnostic settings in Azure Monitor, see Tutorial: Collect and analyze resource logs from an Azure resource.

有关将 Azure AD 日志流式传输到事件中心的信息,请参阅教程:将 Azure Active Directory 日志流式传输到 Azure 事件中心For information about streaming Azure AD logs to an event hub, see Tutorial: Stream Azure Active Directory logs to an Azure event hub.