Microsoft Entra ID
Identity and access management (IAM) — Microsoft
What is this product?
An identity system that records every sign-in attempt: which user, from which address, and the outcome as a ResultType code — and it can block sign-in or revoke sessions.
About the company
Microsoft's cloud identity service, formerly named Azure Active Directory. It is the front door to Microsoft 365 and thousands of applications.
What does an analyst do inside it?
- Searches `SigninLogs` for the user's failed sign-in attempts.
- Separates a wrong password from a bypassed second factor.
- Follows the address and country to spot unusual sign-ins.
- Blocks sign-in or revokes sessions once a compromise is confirmed.
Its search language
These examples are written in the syntax the product itself accepts.
- SigninLogs | where ResultType == "50126"
- SigninLogs | where UserPrincipalName == "admin@example.com"
The field names it uses
- UserPrincipalName
- IPAddress
- OperationName
- ResultType
- DeviceDetail
- AppDisplayName
Practise it now
Pick this product inside the simulator and the field names, search language, severity wording and response actions all switch to match how it works.
Open the simulatorWhere does it show up in the job market?
Most account-compromise cases are analysed from its logs, and reading ResultType codes is an immediately practical skill.
Tools in the same category
The content is educational and follows the product's style. ShiftZero is not affiliated with the vendor and does not run its software.