scope-drift-detection

Scope drift is detected by establishing a 90-day behavioral baseline for Entra ID service principals and user accounts, then comparing recent activity to calculate a multi-dimension drift score. You simply request an investigation for a specific SPN or UPN to start the analysis.

Quantifying identity scope drift requires correlating data across Microsoft Sentinel sources including AuditLogs, SigninLogs, SecurityAlert, DeviceNetworkEvents, and Identity Protection. These sources provide the behavioral signals needed to compute the 90-day baseline and multi-dimension drift score.

Yes, you can generate Markdown reports for scope drift analysis. The skill outputs results in either inline summaries for quick triage or structured Markdown reports specifically formatted for enterprise security investigation handoffs and team review.

A drift score in identity security quantifies the behavioral deviation of service principals and user accounts from their established 90-day baseline. This multi-dimension metric identifies gradual access expansion and behavioral changes across Entra ID entities before security incidents occur.

Yes, scope drift detection works with both Entra ID service principals and user accounts. The skill automatically detects the specified entity type, selects the appropriate data sources, and applies the 90-day baseline comparison and drift scoring calculation accordingly.