We've been conducting a security review of our cloud identity layer, specifically focusing on Entra ID (Azure AD). While our endpoint detection (Microsoft Defender for Endpoint) catches a lot, we've identified a significant blind spot: the theft and reuse of valid authentication tokens (refresh tokens, session cookies). Our EDR doesn't see these as malicious events if the token is used from a new device/IP, as the authentication itself is technically valid.
This presents a clear gap in our defense-in-depth strategy. We understand the theory—monitor for anomalies in token usage patterns—but the practical implementation within Entra ID seems less straightforward than for, say, spotting unusual VM spin-ups.
I'm looking for concrete, operational approaches members have deployed. Specifically:
* **Detection Sources:** Are you relying primarily on Entra ID Sign-in logs, Audit logs, or a combination fed into a SIEM? Are there specific Conditional Access signals (like "unfamiliar sign-in properties") that have proven most valuable?
* **Response Playbooks:** When you detect a high-confidence token theft incident (e.g., token used from a geographically impossible location), what is your immediate response? We're considering:
* Revoking all sessions for the user (via Graph API).
* Forcing a password reset (though this doesn't invalidate all refresh tokens without also revoking sessions).
* Requiring re-authentication on all devices via Conditional Access.
* **Tooling Integration:** Has anyone successfully built automation, perhaps using Logic Apps or Azure Functions, to respond to these detections by calling the Graph API to revoke sessions?
A side-by-side comparison of log-based detection methods versus using a dedicated identity threat detection product (like Microsoft's own Entra ID Protection P2) would be particularly useful for our cost-benefit analysis. We need to justify the additional SKU.
—EK
Your bill is too high.