Excluding Entra ID User Groups

ISSUE

The customer has a large number of Entra ID groups and user accounts (1600+ groups, 30k users) but a limited license for 1270 users. They need to exclude a significant portion of these groups from ingestion to avoid exceeding their license count. The Red Canary portal only allows for excluding individual groups, which is not feasible for such a large number. The customer wants to know the best way to filter out a large number of identity groups.

RESOLUTION

1. Create a "master exclusion" group (e.g., "RedCanaryExclusion") in your Entra ID tenant.
2. Add all groups that should not contribute to the license count to this "RedCanaryExclusion" group.
3. In the Red Canary portal, when configuring the Entra ID integration, specify the name of this "RedCanaryExclusion" group under the Advanced Configuration section.
4. Confirm that the exclusion feature currently only impacts licensing usage and may not mitigate log ingestion or prevent investigations/threats on these excluded identities.

For more information and detailed steps, refer to: Integrate Microsoft Entra ID with Red Canary

Keywords

Entra ID, Azure Active Directory, AAD, exclusion group, licensing, license count, user ingestion, group ingestion, advanced configuration, RedCanaryExclusion