Monitoring

Which page for which question#

Sign-in Activity#

Every sign-in, event by event, with the decision (allow, challenge or deny) and the reason. This is the page to open when one person reports one problem.

The list covers three moments, and each line says which it was:

Opening a line starts with the reason in one sentence ("blocked because the trust score was 40, below the 60 the policy requires — the address belongs to a VPN service"), then the address, who runs it, the score, and every check with its result. Each line has a reference, SI- and a number. It is the reference printed on the page a refused person sees, and typing it into Account or reference opens that line.

Stopped by the device policy lists sign-ins the device check refused or challenged, with the machine and the checks that failed. The list below is the network policy's, so a sign-in the network allowed and the device policy then refused appears there as allowed and here as refused.

During sessions, above the list, is what the policy did after sign-in: a session that moved and was allowed to, a session that moved and was not, from which network to which and what the new one is; a session ended on a re-check, with the rule; a session ended because its device stopped meeting the device policy; a session sent to sign in again because its device now needs a second factor, or left open because it was opened with one; and a request refused because the session had already been ended, with who ended it. Session re-checks are listed with the sign-ins but are not counted as sign-ins in the totals or the charts.

People#

Everyone who reached your application in the window, worst first.

The ranking is a list of reasons, not a score to trust on its own. Each person earns points for things that actually happened, and every point is shown beside their name: "stopped twice, and signed in from a network they have never used before". The weights only decide the order. The reasons are the answer.

The watchlist#

Add a person to the watchlist from People. While they are watched their alert thresholds are halved, so the first unusual thing is raised sooner.

Every watchlist entry expires. Watching is something you renew on purpose, not something set once and forgotten.

Access Map#

Devices, people, networks and your application, drawn as one graph:

Devices ── People ── Networks ── Your application

The person sits in the middle on purpose. A sign-in does not record which device made it, and a device check does not record which network it came from. The person is the only thing both sides share, so the map joins through them and does not invent a link that was never recorded.

It also shows orphan devices: machines that report posture but never sign in. Either a misconfigured agent, or something you did not expect to be there.

Coverage#

State, not events. Three questions that cannot be read off a list without doing the arithmetic yourself:

Coverage measures sign-ins that happened, not settings. A tenant can have an authenticator switched on and still show poor coverage, because switching a factor on does not mean anyone enrolled.

Widening the window finds more dormant accounts; narrowing it makes coverage look better by leaving people out. Compare like with like when you quote a figure.

The security report#

A summary of the month that you can hand to someone else: your management, your auditor, your own customer.

Names shown as user-xxxxxxx#

Pseudonymous view is switched on for your tenant. People are shown by a stable pseudonym and are not linked to their timeline. See Privacy.