Monitoring High Risk Azure Logins 

This report describes how a SOC detected and investigated Business Email Compromise (BEC) and account takeover activity using Azure/Entra Identity Protection signals. It outlines key attributes to examine (IP, operating system, ASN, country), discusses common false positives (travel, mobile devices), summarizes Entra risk detection event types, and provides a Sigma rule to detect high-risk atRisk sign-ins that require multi-factor authentication — indicating likely credential compromise.