Why does identity need its own monitoring?
An attacker who gets in with a valid username and password doesn't need malware. They sign in, read email, download files from SharePoint or Drive and create rules, all with legitimate tools. To the EDR, none of that has to look suspicious.
In its Digital Defense Report 2025, Microsoft states that identity attacks grew 32% in the first half of 2025, that more than 97% of them are password attacks and that MFA can block more than 99% of them. Google's Cloud Threat Horizons Report (H1 2026) notes that in the cloud and SaaS incidents Mandiant responded to in the second half of 2025, attackers exploited identity issues for initial access in 83% of cases.
Which identity signals give away a compromised account?
| Signal | What it may indicate | Where you see it |
|---|---|---|
| Sign-in from an unusual country, network or device | Stolen credentials in the hands of a third party | Entra ID sign-in logs, Okta System Log, Google Workspace audit logs |
| Several rejected MFA prompts, then one accepted | MFA fatigue: the attacker keeps trying until the user accepts | MFA events from the identity provider |
| Registration of a new MFA method | Persistence: the attacker adds their own phone or app | Authentication methods audit logs |
| Many password failures spread across accounts | Password spraying | Sign-in logs and domain controller events |
| Consent granted to an unknown OAuth app | Persistent access to the mailbox or files without needing a password | App audit logs in Entra ID or Google Workspace |
| Addition to privileged groups or a role change | Privilege escalation | Directory audit logs |
| Anomalous Kerberos or replication requests | Kerberoasting or DCSync in Active Directory | Domain controller security events |
A single signal is rarely enough: impossible travel can turn out to be a VPN. What confirms the compromise is the sequence, for example an unusual sign-in, a new MFA method and a mailbox rule within the same hour.
What response actions can be taken on an identity?
The actions are similar across providers, even if the names change. It's worth combining them, because each one closes a different door:
- Revoke sessions: this invalidates refresh tokens and session cookies. For Microsoft Entra ID, the documentation warns that revocation can take a few minutes and that applications using access tokens keep access until the token expires (one hour by default), except for those that support continuous access evaluation (CAE).
- Force a password change. For hybrid identities, Microsoft recommends disabling the account and resetting the password twice in on-premises Active Directory; if you change it from the cloud, check that password writeback is enabled so the change reaches the on-premises directory.
- Block or suspend the account while you investigate. Use this carefully on service accounts, because it can stop applications.
- Remove MFA methods added by the attacker and revoke suspicious OAuth consents.
- Mark the user as compromised, in providers that support it, so that risk-based Conditional Access policies take effect.
How does it differ from email and endpoint integrations?
Identity is the common thread for almost everything else: email, cloud files, VPN and SaaS applications all depend on the same sign-in. That's why its actions have broader reach than isolating a device. Blocking an account cuts off the attacker's access to all those services at once, and the legitimate user's too, so these actions usually require human validation.
What should you check in your identity provider?
- Sufficient log retention: with some licenses, the console only keeps sign-ins for a few days.
- The list of emergency access accounts and service accounts that must never be blocked automatically.
- Usual locations and IP ranges (offices, corporate VPN), to reduce false positives.
- For on-premises Active Directory, security event auditing enabled on the domain controllers, not just Entra ID logs.
How Ciberia helps
Ciberia MDR integrates with your identity provider and monitors anomalous sign-ins and MFA and privilege changes 24/7, correlated with email, endpoint and cloud. Ciberia CTM provides a signal before the attack, your company's leaked credentials, and Ciberia Intel adds context on the infostealers and campaigns that steal them. When an account is compromised, the AI proposes the response, an analyst validates decisions with impact, and the action is orchestrated according to the tool: revoking sessions, forcing a password change or blocking the account. The contractual SLA is 15 minutes from critical alert to initial containment.
