How to analyse Microsoft Entra ID logs to detect account compromises 🛡️
Learn how to configure an agent in Microsoft 365 Copilot to automate the analysis of Entra ID logs, spot anomalous sign-ins and generate structured responses for Incident Response.
Introduction
Securing corporate accounts is an absolute priority. Anomalous sign-ins, coming from unusual locations or unauthorised devices, can be crucial indicators of a compromise. In this article, we will look at how to configure a custom Copilot agent, M365 – Compromissioni IT Sec, to analyse Microsoft Entra ID (formerly Azure AD) logs and generate structured technical responses, ready for security teams.
Why a Dedicated Agent?
Microsoft Entra ID’s native tools provide detailed information on sign-ins, but what is often missing is an automated, contextual analysis focused on identifying incidents quickly.
A dedicated agent fills this gap by offering:
- Evidence of Usual Patterns: Identifies and establishes a user’s typical sign-in patterns (location, device, browser).
- Identification of Suspicious Events:
- Sign-ins from foreign countries or from IPs associated with VPNs/proxies.
- Unusual browsers or operating systems.
- Anomalous or suspicious MFA attempts.
- Timeline Generation: Reconstructs a detailed timeline of critical events for easy investigation.
- Structured Response (Incident Response): Produces a technical response with a conclusion and recommended actions.
This Copilot agent was built to automate the analysis and reduce the time to detect and respond (MTTR).
How to Configure the Agent in Microsoft 365 Copilot
The key to the agent’s effectiveness lies in how it is configured in Copilot Studio (or Microsoft 365 Copilot, depending on the integration).
1. Required Sources
The agent works by analysing raw log data. Prepare the following:
- Sign-in Logs CSV file: Exported directly from Microsoft Entra ID.
- Go to Microsoft Entra ID → Monitoring & health → Sign-in logs.
- Select the period of interest (e.g. the last 7 days) and click Download CSV.
- Official Microsoft Documentation (for context):
2. Creating the Agent in Copilot Studio
When creating the custom agent, define its instructions precisely.
| Field | Value |
|---|---|
| Agent Name | M365 – Compromissioni IT Sec |
| Description | Analyses Microsoft Entra ID sign-in logs to detect anomalies and possible compromises, providing a technical response ready for remediation. |
Main Instructions (System Prompt)
- Analyse the Microsoft Entra ID sign-in logs CSV files.
- Identify the usual sign-in patterns (location, device, browser).
- Highlight anomalous sign-ins (unusual locations, VPN/proxy IPs, uncommon browsers).
- Reconstruct the timeline of suspicious events.
- Provide a technical summary with:
- Summary of usual sign-ins.
- Evidence of anomalies.
- Timeline of suspicious events.
- Technical conclusion (e.g. “High/low risk of compromise”).
- Recommended actions (remediation).
- Use tables and bullet points for maximum clarity and readability.
- If key data for the analysis is missing (e.g. the IP field is empty), flag the limitation to the user.
Suggested Prompts for Effective Responses
Once the agent is ready, the effectiveness of the response depends on how clear the user’s prompt is.
| Prompt | Focus |
|---|---|
| Prompt 1 – Full analysis with timeline and ticket | Analysis of behavioural anomalies, suspicious IPs, full timeline and output formatted for the ticket. |
| Prompt 2 – Focus on IP and MFA | Targeted analysis of technical attack indicators (VPN, proxy, MFA attempts). |
| Prompt 3 – Summary report for managers | High-level summary for a quick overview, with emphasis on risk and recommendations. |
The Perfect Prompt for a Complete Response
This prompt combines all the elements needed for a preliminary forensic analysis:
“Analyse the attached sign-in logs file. I want to know whether there are successful sign-ins from locations, devices or browsers that are unusual compared with the user’s normal behaviour. Highlight any sign-ins from IPs associated with VPNs, proxies or foreign countries. Provide a detailed timeline of the suspicious events and a response ready to be added to a ServiceNow ticket, including a technical conclusion and recommended actions.”
Best Practices for Accurate Responses
To make sure the agent delivers the most accurate and useful results:
- Complete the Logs: The more Entra ID fields are included in the CSV, the more accurate the behavioural analysis will be.
- Compare Against a Baseline: The agent is effective because it identifies anomalies against the user’s usual behaviour, not just against static rules.
- Ask for Recommended Actions: Turn the analysis (what happened) into concrete remediation (what to do).
- Integrate with Security Policies: Analyses should always be put in the context of the active company policies (e.g. Conditional Access, MFA enforcement, geofencing).
Conclusion
The configured Copilot agent is a powerful tool for speeding up the response to security incidents. By automating the analysis of raw Entra ID logs and providing immediate insights, it reduces detection time and significantly improves account protection. Configuring it correctly in Microsoft 365 Copilot is the decisive step in turning a mountain of raw data into immediate operational decisions.