authentication-tracing

Trace Entra ID sign-ins to detect token reuse by analyzing SessionId chains across SigninLogs and AADNonInteractiveUserSignInLogs. This process distinguishes fresh MFA activity from credential theft by mapping interactive events against non-interactive token usage.

Forensic analysis of SessionId chains is the process of tracking authentication flows to determine if a sign-in required fresh MFA or reused a previous token. It identifies token theft by evaluating interactive MFA events against subsequent non-interactive sessions.

Assess geographic anomalies in Entra ID sign-in logs by analyzing IP progression using pre-generated investigation JSON ip_enrichment data. This maps geographic movements within SessionId chains to detect impossible travel or suspicious token usage locations.

Yes, you need a pre-generated investigation JSON to provide the ip_enrichment data required for geographic anomaly assessment. You must run a user investigation first to map sign-ins to SessionId values before starting the authentication tracing workflow.

Yes, this authentication tracing workflow analyzes AADNonInteractiveUserSignInLogs alongside SigninLogs. It compares interactive MFA events with non-interactive token reuse across both log sources to provide a repeatable forensic workflow for identifying credential theft.