Identity-based attacks are a major concern for organizations operating cloud applications and services. A compromised account can provide an attacker with access to business data, applications, and other resources.
Microsoft provides several security capabilities that can work together to identify and investigate these risks. Microsoft Entra ID Protection focuses on identity and sign-in risks, while Microsoft Sentinel provides broader security monitoring and correlation across an organization’s environment.
What Is Microsoft Entra ID Protection?
Microsoft Entra ID Protection is designed to help organizations detect, investigate, and remediate identity-related risks.
It analyzes identity and sign-in signals to identify suspicious activity. These detections can help security teams understand whether a user or authentication request may be associated with a potential compromise.
Microsoft describes detections involving risks such as leaked credentials, password-spray activity, and suspicious sign-in characteristics.
Understanding Identity Risk
Identity Protection considers risk at different levels.
A user risk can indicate that an account may have been compromised, while sign-in risk relates to the likelihood that a particular authentication attempt may not be from the legitimate account owner.
Microsoft Entra ID Protection categorizes risk into low, medium, and high levels. These levels help security teams determine which events require closer investigation and remediation.
How Threat Detection Works
Threat detection begins by identifying unusual or potentially dangerous activity.
Examples can include:
- Leaked credentials
- Password spray attempts
- Suspicious IP addresses
- Unusual sign-in properties
- Unexpected authentication patterns
- Other anomalous identity activity
The purpose is not simply to generate alerts. Security teams can use the resulting risk information to investigate events and apply appropriate security controls.
The Role of Microsoft Sentinel
Microsoft Sentinel is a cloud-native security information and event management platform. It can collect security information from users, applications, devices, infrastructure, and other sources.
This broader visibility can help security teams connect identity-related activity with other events occurring across the environment. Microsoft describes Sentinel as providing threat detection, investigation, hunting, and response capabilities.
Connecting Entra ID Protection With Sentinel
One of the benefits of integrating these technologies is the ability to examine identity risks alongside other security information.
Entra ID Protection can provide risk information that Sentinel can use for additional analysis and correlation. This can help security teams determine whether a suspicious sign-in is an isolated event or part of a larger attack pattern.
For example, a risky authentication event could be investigated alongside activity involving applications, devices, network connections, or other alerts.
Why Correlation Matters
Looking at a single security event can make it difficult to understand the full situation.
Correlation adds context.
A suspicious sign-in might initially appear to be a simple authentication issue. When combined with other alerts, however, it may provide evidence of a broader security incident.
This is why integrating identity monitoring with wider security operations can help teams investigate incidents more effectively.
Investigating Risky Sign-Ins
When an identity risk is detected, security teams can review contextual information about the event.
Microsoft recommends examining details such as:
- Timestamp
- Application
- Device
- Location
- IP address
- User agent
- Related security alerts
These details can help analysts determine whether the activity is expected or potentially suspicious. Microsoft also recommends checking related alerts in Sentinel or Microsoft Defender when those services are available.
Using Risk-Based Conditional Access
Detection is only one part of identity protection.
Organizations can also use risk information to influence access decisions through Microsoft Entra Conditional Access.
Depending on the configured policies and risk level, an organization may require additional authentication, restrict access, or apply other controls to reduce the possibility of account compromise.
This creates a more adaptive security approach than relying only on static access rules.
Benefits for Security Teams
Combining identity protection with centralized security monitoring can provide several practical benefits.
Better Visibility
Security teams can view identity risks alongside broader security information.
Faster Investigation
Additional context can make it easier to understand suspicious authentication events.
Risk-Based Response
Organizations can apply different controls depending on the level and type of detected risk.
Centralized Security Operations
Sentinel can bring information from multiple sources into a broader security monitoring environment.
Building an Effective Detection Strategy
Technology alone does not create a complete security strategy.
Organizations should regularly review identity policies, monitor risky users and sign-ins, maintain appropriate authentication controls, and establish clear procedures for investigating alerts.
Security teams should also document how different risk levels are handled and who is responsible for responding to incidents.
Regular review is important because attack techniques and detection capabilities continue to change.
Final Thoughts
Threat detection becomes more effective when identity security and broader security monitoring work together.
Microsoft Entra ID Protection provides visibility into risky users and sign-ins, while Microsoft Sentinel can help correlate those signals with security events across the wider environment.
For organizations using Microsoft’s security ecosystem, connecting identity risk information with centralized monitoring can provide security teams with additional context for investigation, response, and ongoing identity protection.
