scope-drift-detection-user

Detect scope drift in Entra ID by establishing a 90-day behavioral baseline of interactive and non-interactive sign-ins, then scoring recent activity against it. It analyzes distinct applications, source IPs, geographic locations, and device usage to identify access creep.

Scope drift in identity security is the gradual, often imperceptible expansion of user access or behavior beyond an established baseline. It can evade traditional threshold-based detections and indicate potential privilege creep or a compromised account.

Analyze user behavior anomalies by computing weighted drift scores across dimensions like distinct applications, source IPs, geographic locations, and device usage. The process correlates these findings with audit logs, security alerts, and Identity Protection events.

Yes, you can monitor non-interactive sign-ins for security monitoring. The Skill includes both interactive and non-interactive sign-ins when building a 90-day behavioral baseline to ensure comprehensive coverage of user account activity.

Yes, scope drift detection correlates drift signals with CloudAppEvents and EmailEvents. It also cross-references audit logs, security alerts, and Identity Protection events to corroborate findings and identify subtle anomalous behavior.

Threshold-based detections for user behavior often miss gradual access creep because changes remain below static alert thresholds. Scope drift detection addresses this limitation by building a dynamic 90-day behavioral baseline to identify subtle, incremental privilege expansion.