Domain: Identity

Microsoft Entra ID Exccessive Account Lockouts Detected

Jun 10, 2025 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Data Source: Entra ID Sign-in Logs Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide ·

Share on:

Identifies a high count of failed Microsoft Entra ID sign-in attempts as the result of the target user account being locked out. Adversaries may attempt to brute-force user accounts by repeatedly trying to authenticate with incorrect credentials, leading to account lockouts by Entra ID Smart Lockout policies.

Entra ID Protection - Risk Detection - User Risk

Jun 4, 2025 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Use Case: Identity and Access Audit Use Case: Threat Detection Use Case: Risk Detection Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more.

Entra ID Protection - Risk Detection - Sign-in Risk

Jun 4, 2025 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Use Case: Identity and Access Audit Use Case: Threat Detection Use Case: Risk Detection Tactic: Initial Access Resources: Investigation Guide ·

Share on:

Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more.