Entra ID Signin Analyzer

Sorting through raw Entra ID (Azure AD) sign-in logs manually makes it nearly impossible to spot sophisticated session hijacking or MFA fatigue attacks. This skill automates the triage of exported logs to identify high-risk anomalies that standard alerts often miss.

What it does

• Detects MFA fatigue by flagging repeated denials followed by a sudden success.
• Identifies impossible travel between logins using geographic distance and time calculations.
• Flags legacy auth usage including IMAP, POP, and SMTP that bypasses MFA.
• Surfaces hosting infrastructure sign-ins originating from VPNs, Tor nodes, or data centers.
• Spots token replay indicators where the same session appears across multiple IPs.
• Analyzes auth flows like Device Code and ROPC which are frequently abused in phishing.

How it works

1. Export logs from the Entra admin center, Microsoft Graph API, or Log Analytics in JSON or CSV format.
2. Provide context such as the user's home country and travel speed thresholds to reduce false positives.
3. Analyze findings using the triage guidance to distinguish between mobile carrier shifts and actual compromises.

Frameworks & tools

The skill processes data typically sourced from Microsoft Graph API, Entra ID (Azure AD), and Azure Log Analytics (KQL). It is optimized for scripts/entra_signins.py execution environments.

Why this beats prompting it yourself

Generic prompts struggle to calculate geographic distances between IPs or track stateful MFA patterns across thousands of log lines. This skill applies specific cybersecurity logic to correlate session IDs and authentication methods accurately.

Use cases

• Incident response for suspected Microsoft 365 account takeovers.
• Security audits to identify users bypassing Conditional Access policies.
• Proactive hunting for password spraying attempts against your tenant.
• Phishing investigation specifically targeting Device Code flow abuse.

Known limitations

Impossible travel results depend on IP geolocation accuracy, which can be skewed by corporate VPNs or mobile carrier egress points. Requires logs exported in JSON or CSV format.