Azure Identity Compromise Lab: Entra Sign-In Triage
You triage a fictional Entra ID account takeover end to end. A password spray alert, a token that keeps working after the first sign-in, a new authentication method, a forwarding rule, a malicious app consent and a rogue secret on an app registration: make each call and see which ones a password reset would have missed. Want the controls behind the answers? Read the Secure Azure Architecture guide or score your own tenant with the Azure Security Checklist.
You are Jordan Ellis, a cloud security analyst at Contoso Retail, a fictional company with the tenant contoso.example. A risky sign-in alert lands for Priya Nair. Across 11 decisions you triage Entra sign-in logs, contain a compromised account, deal with a malicious app consent, an inbox rule and a new service principal secret, and decide what to change. Everything is fictional: the people, the tenant and the addresses (documentation ranges). No commands or queries appear. Each call is scored 0 to 10 with the Microsoft Learn page behind the rationale.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab for cloud security analysts: a fictional Entra ID tenant (contoso.example) raises a password spray and unfamiliar sign-in alert, and you work the incident to the end.
- You make 11 scored decisions: reading sign-in and audit logs, containing tokens and sessions, a rogue authentication method, inbox rules, a malicious OAuth consent grant, user-consent settings, a new service principal secret, scoping and logging.
- Every rationale cites the Microsoft Learn page behind it, read on 4 November 2026. Where a step is PlayCISO practice rather than a Microsoft statement, the feedback says so.
- Free to play, no sign-up needed to run it. A final score and grade, a shareable scorecard and next-step links.
- Defensive and educational only. No commands, queries or attack tooling appear, and the tenant, people and IP addresses are fictional (documentation ranges).
Frequently asked questions
What does the Azure Identity Compromise Lab teach?
How to triage and contain an identity compromise in Microsoft Entra ID and Azure. You read sign-in logs and risk detections, contain the account with session and token revocation, and find the ways an attacker keeps access after a password reset: a new authentication method, an inbox rule, a malicious OAuth consent grant and a new secret on an app registration.
Is a password reset enough after an account takeover?
Not by itself. Microsoft's access-revocation guidance is to disable the user, revoke refresh tokens and disable devices, and notes that access tokens last one hour by default. The lab also shows persistence that a reset never touches: a consent grant, a registered authentication method and an app credential.
Does the lab need a Microsoft tenant or any credentials?
No. It is a decision lab in your browser. The tenant, users and addresses are fictional. You do not connect to Azure or enter any account details.
Which Microsoft sources does it use?
Microsoft Learn pages on Entra ID Protection risk detections, investigating risk, sign-in logs, revoking user access, risky OAuth apps, user consent settings, app registration security, emergency access accounts, Log Analytics and Microsoft Sentinel. Each answer names the page it relies on, and the list is at the bottom of this page with the access date.
How is it scored?
Each decision scores 0 to 10 and the final score is the share of the maximum. The grade bands run from "Still inside" to "Tenant defender". The debrief shows the best choice and the source for each step.
Can I download my debrief?
The debrief is shown on the page for free. Downloading it as Word, PDF or Markdown needs a paid plan.
Sources
Read on 4 November 2026. Written in our own words; no Microsoft text is reproduced.
- Microsoft Learn: What are risk detections? (Microsoft Entra ID Protection)
- Microsoft Learn: Investigate risk with Microsoft Entra ID Protection
- Microsoft Learn: Sign-in logs in Microsoft Entra ID
- Microsoft Learn: Revoke user access in Microsoft Entra ID
- Microsoft Learn: Investigate and remediate risky OAuth apps (Defender for Cloud Apps)
- Microsoft Learn: Configure how users consent to applications (Microsoft Entra ID)
- Microsoft Learn: Security best practices for application properties in Microsoft Entra ID
- Microsoft Learn: Workload identities overview (Microsoft Entra)
- Microsoft Learn: Manage emergency access admin accounts in Microsoft Entra ID
- Microsoft Learn: Log Analytics workspace overview
- Microsoft Learn: What is Microsoft Sentinel?
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.