Microsoft Entra ID Sign-in Investigation Explorer

Shadows VMB@Vemorian_Mort

•updated Jul 9, 2026•42•2•34

This rule serves as an investigation framework for Microsoft Entra ID sign-in events. It enables security analysts to filter, normalize, and inspect user authentication activities, including sign-in types (interactive/non-interactive), device management status, user risk levels, and conditional access status. The query is designed for incident response and forensic analysis rather than automated alerting.