Hunting Impossible Travel in Sentinel with KQL
Two sign-ins too far apart in time and distance to be one person. In Sentinel, KQL's prev() and a distance function are all it takes.
Identity
Break-Glass Accounts: The Ones You Hope You Never Use, Done Properly
Entra break-glass (emergency access) accounts: cloud-only, excluded from every policy, watched closely, and tested before you need them.
Hunting Password Spray in Sentinel: One Password Against a Thousand Doors
Brute force tries many passwords on one account. Spray tries one password on many accounts, and hides under your lockout threshold. Here's the shape it leaves.
Conditional Access: Getting It Right Without Locking Yourself Out
Break-glass first, report-only always, and the other habits that keep a Conditional Access rollout from ending in a lockout.