identity-threat-detect

To detect impossible travel and brute-force patterns in Azure AD sign-in logs, you need to correlate time gaps, geographic changes, and failed-attempt bursts. This process scans recent sign-in activity and matches anomalies against historical location baselines to flag risky authentications.

Identity threat detection for Azure sign-ins is the process of scanning logs for anomalous access patterns like impossible travel, unfamiliar locations, and brute-force behavior. It correlates these findings with existing identity alerts to produce a risk-ranked report for incident investigation.

To investigate risky Azure AD sign-ins for a specific user, scan their recent authentication logs for impossible travel and brute-force patterns. The analysis retrieves sign-in logs and correlates them with existing identity alerts to generate a structured, risk-ranked output.

Yes, you can scan the entire Azure AD population for identity threats over the last 24 hours. The scan retrieves recent sign-in logs across all users, identifies anomalous patterns like unfamiliar locations, and outputs a prioritized identity risk report.

Alert correlation for Azure AD identity threats works by connecting detected sign-in anomalies with existing identity-related alerts. This checks known incidents during the investigation, matching patterns like impossible travel against current alerts to produce a prioritized response report.