· 4 min read
Investigating a suspicious sign-in in Entra ID, step by step
What to check in the sign-in logs, which KQL queries to run, how to compare against the user's normal behavior, and when to revoke sessions and reset access.
Category
Tutorials
Step-by-step guides you can follow in a real tenant, from the first query to the final report.