user-investigation

You can investigate suspicious sign-in activity by analyzing Entra ID audit logs, sign-in anomalies, MFA status, and Identity Protection risk signals. This requires the User Object ID and SID to perform a deep dive into recent activities and identify the scope of the threat.

A deep dive security analysis on an Office 365 user requires the User Object ID and SID. These identifiers enable the comprehensive review of audit logs, Office 365 activity, device compliance, and Identity Protection risk signals to identify compromises.

To generate an HTML report for an identity protection incident response, analyze Entra ID sign-in patterns, audit logs, and security incidents. The investigation can deliver results directly as a polished HTML report, inline chat summary, or markdown file.

Yes, a Microsoft Entra ID user investigation comprehensively checks MFA status and device compliance. The analysis evaluates MFA configuration, device compliance states, sign-in anomalies, and audit logs to identify suspicious activity and compliance issues.

The best way to summarize Entra ID security alerts is to analyze audit logs, sign-in anomalies, and Identity Protection risks. The investigation delivers a concise inline chat summary detailing the exact nature and scope of the threat for the compromised user.