The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A suspicious Microsoft 365 sign-in is investigated by tracing the complete activity chain: establish exactly who signed in, how and from where, compare the event with that user’s normal pattern, then correlate sign-ins with directory changes, Microsoft 365 activity, and resource access. Treat risk detections and IP locations as evidence to weigh—not as proof of compromise. If the evidence supports compromise, contain the identity, revoke access, preserve records, and document the final disposition.
What a suspicious sign-in investigation must establish
The objective is not merely to decide whether a country, IP address, or application looks unfamiliar. You need to answer four questions for the affected Microsoft 365 identity:
- Who authenticated, including whether the identity was a human user, service principal, or managed identity.
- How authentication occurred: interactive or non-interactive flow, client application, authentication methods, Conditional Access result, and any failures or retries.
- What resource was requested, and whether the request succeeded.
- What happened afterward: directory changes, mailbox or file activity, downloads, administrative modifications, or other actions that could indicate impact.
This workflow determines what your tenant’s records support. It cannot, by itself, prove that an event was malicious or show data access when the relevant logs were not retained or were never routed to a searchable store.
1. Establish the event and the identity
Open the current Entra sign-in logs
- Sign in to the Microsoft Entra admin center.
- Open Monitoring & health > Sign-in logs.
- Set a time window wide enough to include the alert and the activity immediately before and after it.
- Search for the affected account and open each relevant event’s details pane.
Record the event before changing the account. Your working record should include the user or workload identity, timestamp, application or client, target resource, success or failure status, authentication details, device information, IP address, estimated location, and user agent. Microsoft frames a sign-in around who connected, how the connection was made, and what resource was accessed; all three dimensions are needed to interpret an anomaly.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Capture the fields that distinguish one event from another
| Dimension | What to record | Why it matters |
|---|---|---|
| Identity | User principal name or workload identity; account type | Human users, service principals, and managed identities have different normal patterns and controls. |
| Time | Portal timestamp and a normalized UTC value | Entra displays time localized to the viewer’s time zone, not necessarily the affected user’s zone. |
| Application and client | Application name, client type, protocol or user agent | An unfamiliar client can be more informative than an unfamiliar city. |
| Target resource | Resource or service requested | Access to an administrative or sensitive resource changes the severity assessment. |
| Outcome | Success, failure, result details, and authentication sequence | Several failures followed by a success may indicate a normal retry, a password attack, or a token problem. |
| Policy | Conditional Access policies and their outcomes | A policy may have blocked the request, required MFA, or allowed it under a specific condition. |
| Device and network | Device identity, registration or compliance state, IP address, and estimated location | These attributes must be compared with the account’s established baseline. |
| Correlation | Correlation ID and any related request identifiers | One authentication flow can produce multiple records in Log Analytics. |
Include all relevant sign-in types
Review both interactive and non-interactive user sign-ins. A person may authenticate interactively once and then use a token or background client that appears as non-interactive activity. The legacy sign-in log experience includes only interactive user sign-ins, so relying on that view can omit important evidence. If the incident involves a workload identity, inspect service-principal or managed-identity activity as well; do not force a machine identity into a human-user baseline.
2. Compare the event with normal behavior
An event becomes suspicious because it differs from a credible baseline or connects with other evidence. Build the baseline from the same account’s earlier activity and, where useful, from comparable users or applications. Do not treat a single risk alert as a complete account of what happened.
Build a user baseline
- Review the user’s usual applications and target resources.
- Compare registered and compliant devices, operating systems, browsers, and user agents.
- Compare normal IP ranges, network providers, locations, and access times.
- Check whether the authentication method sequence is typical, including MFA prompts, password-only attempts, or token-based activity.
- Note the user’s normal Conditional Access outcomes and whether a policy was newly applied, bypassed, or changed.
- Look for activity immediately before and after the event instead of examining the alert in isolation.
Use risk detections as investigation leads
Related detections can include impossible or atypical travel, anonymous or malware-linked IP addresses, suspicious browsers, password spray, token anomalies or replay, unfamiliar sign-in properties, and suspicious inbox manipulation. These detections help prioritize questions; they do not establish tenant-specific facts on their own. For example, a token-replay signal should be checked against device, application, authentication, and subsequent audit evidence rather than treated as proof that an attacker controlled the account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Interpret IP address and location evidence cautiously
Microsoft’s Entra sign-in guidance states: “There’s no definitive connection between an IP address and where the computer with that address is physically located.” Mobile providers can route traffic through address pools far from the user, and VPNs can make a legitimate connection appear to originate in another city or country. IP-to-location data is therefore a best-effort estimate.
Use the location as one factor alongside the device, application, protocol, user history, timestamp, and other detections. An unfamiliar country is not sufficient evidence of compromise; a familiar country does not make an event safe. Check whether the IP belongs to a known corporate egress, a mobile carrier, a privacy service, or infrastructure associated with previous activity. Preserve the original IP and the portal’s location value in your notes so later analysts can reproduce the assessment.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Normalize timestamps before comparing records from different systems. The Entra admin center localizes displayed time to the viewer’s time zone, not the affected user’s. Convert every event to a common time zone, preferably UTC, and retain the original display time as a reference.
4. Expand from sign-ins to audit and resource activity
Know which log answers which question
| Record source | Primary coverage | Investigation use |
|---|---|---|
| Entra sign-in logs | Authentication requests, client, resource, device, network, policy, and outcome | Determine how the identity connected and whether access succeeded. |
| Entra audit logs | Directory operations such as user and group management | Find changes made to identities, memberships, roles, applications, or other directory objects. |
| Microsoft 365 admin center activity logs | The broader Microsoft 365 activity view | Correlate sign-ins with service activity, administrative changes, and other actions across Microsoft 365. |
| Resource-specific records | Actions in the affected service, such as downloads or mailbox activity | Determine what data or configuration may have been touched after authentication. |
Entra audit logs and Microsoft 365 activity logs are related but distinct. For the full Microsoft 365 view, inspect the activity logs in the Microsoft 365 admin center rather than assuming the Entra audit pane contains every service action. Correlate the records with the sign-in’s identity, normalized time, application, IP, and correlation information.
Look for impact after the authentication
Review actions that could change control of the tenant or expose information. Examples include user or group changes, new or altered administrative assignments, application changes, mailbox-rule or inbox manipulation indicators, data downloads, and access to sensitive resources. The exact records available depend on the services enabled and your tenant’s retention and routing configuration. If the incident concerns insider-risk indicators or unusual data movement, related security tooling such as Microsoft Purview Insider Risk Management may provide additional context.
5. Correlate records without double-counting events
Use a searchable log destination when available
If your tenant routes activity to Azure Monitor Log Analytics, Microsoft Sentinel, or another SIEM, search the SigninLogs and AuditLogs tables over the same normalized time window. Filter first by identity and time, then inspect the application, resource, result, IP, policy, risk fields, and correlation ID. Join or compare the resulting records with audit operations and resource activity rather than counting sign-in rows alone.
A practical investigation sequence in Log Analytics is:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
- Filter
SigninLogsto the affected identity and the incident window. - Project the timestamp, application, resource, result, IP address, device or user-agent fields, risk information, and correlation ID.
- Sort by time and group records by correlation ID to identify retries and related requests.
- Search
AuditLogsfor the same identity and period, then summarize the operation names and target objects. - Compare the time of each successful authentication with the first subsequent directory or resource action.
- Preserve the query, time range, and exported results as part of the incident record.
Understand correlation IDs
One interactive sign-in can appear as multiple Log Analytics records sharing a correlation ID. A common pattern is an MFA failure followed by a successful retry. The portal may merge those requests and display the final outcome, while Log Analytics retains separate rows. Do not report every row as an independent user session until you have checked correlation IDs and the authentication sequence. The same caution applies when comparing portal counts with SIEM counts.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 116. Compare two or more suspicious events consistently
When several alerts concern the same user or related accounts, use one comparison grid instead of a series of informal judgments. Keep the dimensions identical for every event:
| Comparison axis | Questions to ask |
|---|---|
| Identity | Is this the same user, a delegated account, a service principal, or a managed identity? |
| Application and resource | Did the events request the same client and target service? |
| Outcome and authentication | Were there failures, MFA prompts, retries, or a successful token use? |
| Conditional Access | Did the same policies apply and produce the same result? |
| Device | Was the device registered, compliant, and previously associated with the account? |
| Network and location | Do the IP and estimated location fit known egress or mobile/VPN behavior? |
| User agent and protocol | Does the client match the user’s normal software and access method? |
| Time | Are all timestamps normalized to the same time zone? |
| Risk | Which detections fired, and what corroborating evidence supports or weakens them? |
| Correlation | Do records share a correlation ID or belong to one authentication flow? |
| Follow-on activity | What directory, administrative, download, mailbox, or other resource actions followed? |
Compare each event with the account’s normal history and with related users or applications. Similarity between two unusual events can indicate a shared client or policy condition; it does not automatically make either event legitimate.
7. Validate the activity through a trusted channel
When practical, ask the account holder whether they recognize the timestamp, application, device, location, and IP. Use a trusted channel that was not involved in the suspicious activity. Microsoft cautions that email or Teams may themselves be compromised, so do not rely on the potentially affected account to validate itself.
Ask for specific confirmation rather than a general “Was that you?” A user may recognize a normal work session but not know which client or resource generated a non-interactive record. Record what was confirmed, what the user could not verify, and any discrepancy between the user’s account and the log details.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
8. Contain the account when compromise is plausible
Containment should match the evidence and the incident’s urgency. Preserve the relevant records before making changes when doing so will not increase exposure.
- Use risk-based self-remediation when available. If the tenant presents an approved risk-based remediation path, follow it and record the result.
- Reset the password. Do this when credential exposure is possible or the identity cannot be validated.
- Require MFA re-registration. Re-register methods if an attacker may have added, replaced, or enrolled an authenticator.
- Block the account temporarily. Use blocking when continued access presents unacceptable risk or investigation cannot be completed quickly.
- Revoke active sessions and tokens. This limits reuse of existing sessions after credential changes.
- Review policy and account changes. Check for new methods, altered Conditional Access rules, changed memberships, application changes, or an unblock that was not authorized.
Coordinate these actions with the incident plan because blocking or revoking sessions can interrupt business processes and workload identities. For service principals and managed identities, investigate the associated application, credentials, permissions, and workloads rather than applying a human-user response mechanically.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.9. Assign and document the final disposition
After containment and review, mark the user or sign-in as confirmed compromised, confirmed safe, or risk dismissed only when the evidence supports that status. The case record should state which records were examined, how timestamps were normalized, how IP and device evidence was weighed, which follow-on actions were found, what the user confirmed, and which containment steps were taken.
Log SOC actions and their times. Record password resets, MFA changes, blocks, session revocations, policy changes, and later unblocks. This history prevents a future analyst from mistaking an emergency control for an unexplained configuration change.
Recommended Free Tools
Access, roles, licensing, and retention checks
Permissions and feature availability vary by tenant. Microsoft’s risk-investigation guidance identifies Reports Reader as the least-privileged role specified for viewing sign-in and audit logs, and Global Reader for viewing ID Protection risk reports. Full Microsoft Entra ID Protection feature access requires Entra ID P2 or Entra Suite. Confirm current role assignments, entitlements, retention periods, and log-routing settings in the tenant; public guidance cannot reveal those values for your organization.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
If a required record is missing, distinguish between “no activity occurred” and “the tenant did not retain or route the record.” Note the source, time range, retention setting, and any filtering that could have excluded the event. A conclusion that exceeds the available evidence is not a safe incident finding.
Common investigative mistakes and their fixes
Calling an unfamiliar country proof of compromise
Fix: Check mobile and VPN routing, known corporate egress, device state, client, protocol, and user history before deciding.
Using only the legacy sign-in view
Fix: Include non-interactive user activity and workload-identity records when relevant.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCounting every SIEM row as a separate login
Fix: Group by correlation ID and reconstruct the authentication sequence.
Stopping after finding a successful sign-in
Fix: Search Entra audit logs, Microsoft 365 activity logs, and affected resource records for what happened next.
Trusting a response from the affected mailbox or chat account
Fix: Validate through a separate trusted channel.
Changing the account before preserving evidence
Fix: Export or record the relevant sign-in, audit, and activity details first when delay will not increase risk.
Assuming a missing record proves nothing happened
Fix: Check retention, licensing, permissions, ingestion, and the exact log source before drawing a negative conclusion.
Quick Recap
A concise analyst checklist
- Identify the account type and affected identity.
- Capture user, time, application, resource, outcome, authentication details, device, IP, location, user agent, policy results, and correlation ID.
- Review interactive and non-interactive sign-ins, plus service-principal or managed-identity activity when applicable.
- Compare the event with the account’s normal applications, devices, networks, locations, times, and authentication sequence.
- Treat risk detections and IP geolocation as leads that require corroboration.
- Normalize timestamps to a common time zone.
- Review Entra audit logs and the Microsoft 365 admin center activity logs for changes and follow-on actions.
- Use correlation IDs before counting Log Analytics records.
- Validate with the user through a trusted channel when practical.
- Reset credentials, re-register MFA, block the account, or revoke sessions according to the evidence and incident plan.
- Assign a supported disposition and record every SOC action, policy change, and unblock.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
