Microsoft Entra ID Protection risk events are flowing to the Microsoft Sentinel workspace
Overview
Section titled “Overview”Microsoft Entra ID Protection generates risk signals for both user accounts and workload identities (service principals). For AI workloads, the workload identity signals are especially important — they detect unusual authentication patterns and suspicious API activity by the service principals that run as AI agents. This check verifies that both user and workload identity risk event categories are enabled on the Entra ID data connector and flowing to the Sentinel workspace.
When Identity Protection risk events are not flowing to Sentinel, the workspace has no risk dimension for the agent service principals that authenticate to AI endpoints. Threat actors who steal or replicate a service principal credential can exploit this gap because their anomalous sign-in and API activity never reaches the SIEM as a risk signal. Without these events, the organization cannot correlate a high-risk service principal identity with the downstream AI workload access that follows it.
Remediation
Section titled “Remediation”- Connect Microsoft Entra ID Protection to Microsoft Sentinel
- Integrate Microsoft Entra logs with Azure Monitor logs
- Microsoft Entra ID Protection risk policies
Run it
Section titled “Run it”The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
Install-Module ZeroTrustAssessment -Scope CurrentUserConnect-MaesterInvoke-Maester -Pack ZTA -SkipBuiltInLeave out -SkipBuiltIn to run Maester’s own checks in the same run.
About this check
| Severity | High |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | AI |
| Category | AI Threat Detection |
| Product | Azure |
| Feature | Microsoft Sentinel |
| Area | Logging and detection |
| ATT&CK | T1078.004 Cloud Accounts |
| Licence | AAD_PREMIUM_P2&AGENT_365, AAD_PREMIUM_P2, AGENT_365 |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.
A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.