top of page
Overview


This lab focused on investigating authentication activity in Microsoft Entra ID to understand how identity based security telemetry is generated and how a SOC analyst determines whether sign in behavior is benign or suspicious. I simulated realistic authentication activity, reviewed sign in logs, and used time based correlation to distinguish false positives from true security risk.

 
What I Did


Created a test user in Microsoft Entra ID and generated controlled failed sign in attempts followed by a successful sign in. Reviewed Microsoft Entra ID sign in logs to analyze status, error codes, source IP address, location, client application, and authentication details. Compared failed and successful events to assess whether the pattern aligned with user error or potential credential abuse such as brute force or password spraying.

Tools Used


Microsoft Entra ID, Azure Portal, Sign In Logs, Audit Logs, Authentication Error Codes, IP and Location Context

Findings


Sign in logs initially showed no activity until authentication attempts were performed, reinforcing that visibility depends on actual log generating events. Multiple failed attempts in a short time window increased risk confidence, and a successful sign in after failures raised the severity of the investigation. Based on source context and timing, the activity was classified as a true positive requiring monitoring and validation rather than immediate incident response.

​
SOC Takeaway


Identity telemetry is a core part of modern security operations, and authentication failures are only meaningful when analyzed with context. Time windows, error codes, and source consistency help determine whether activity should be treated as noise, monitored, or escalated. This lab reinforced correlation driven investigation rather than relying on isolated alerts.

failuredetails.png
bottom of page