Your settings say what should happen. Your logs say what did.
A tenant can look fine on paper while a password-spraying campaign runs every night. Microsoft keeps the evidence in your sign-in and audit logs, but few businesses have the time to read thousands of rows.
As part of every Entra ID audit, we collect up to 30 days of interactive, non-interactive and service-principal sign-ins plus directory audit logs, and analyze them for the patterns attackers leave behind.
Eight patterns attackers leave in your logs
Password spray
One source trying the same few passwords against five or more accounts.
Brute force
Ten or more failures against one account, and whether the attacker then got in.
MFA fatigue
Three or more denied MFA prompts in a row: someone has the password.
Impossible travel
Sign-ins from two countries within three hours.
Legacy authentication
Sign-ins that skip MFA through old protocols, by user.
Foreign and admin foreign sign-ins
Sign-ins from outside your home country, admins flagged separately.
Risky admin changes
Privilege escalation, Conditional Access changes, new app credentials, consent grants, off-hours changes.
Most-targeted accounts
An exposure score per account so you know whose protection to raise first.
How findings connect into an attack chain
In the sample for Veltrana Logistics (fictional), separate signals in the logs added up to one story. The report shows the chain, the accounts involved and what to do first.
| What the report gives you | Why it matters |
|---|---|
| Top attack sources by IP and country | Block or watch them in Conditional Access named locations |
| Most-targeted accounts with an exposure score | Raise protection first where attackers are aiming |
| Error-code summary of failed sign-ins | Separates attacks from broken apps and typos |
| Sign-ins where no Conditional Access applied | Shows the real gaps in policy coverage |
| Sensitive admin changes, off-hours and by non-admins | Catches persistence: new app credentials, consent grants, policy edits |
It goes to the top of your report
A likely compromise, such as a successful sign-in from an attacking source, is ranked first in the report and the readout, with the accounts involved and what to do first. The audit stays read-only: your team, your MSP or our incident response guidance takes it from there.
| Item | What happens |
|---|---|
| Access needed | A Global Reader account. Your Global Administrator approves our read-only audit app once, with one link. No write permission is ever requested. |
| Requests made | Microsoft Graph read requests only. The tool cannot create, change or delete anything, and every request is logged. |
| What your admin sees | One consent screen listing the read-only permissions. The app “OCSA Entra ID Read-Only Audit” appears under Enterprise applications until you delete it; we suggest deleting it after the engagement. |
| What your security team may see | Our sign-ins in your logs and possibly an automated alert. We tell them the audit date and our sign-in details in advance. |
| What users see | Nothing. No e-mail, prompt, notification or install for any employee or device. |
