Forum Discussion
Unfamiliar sign-in properties does not show more information in Sentinel
We have already setup CA policies with strict policies when it comes to sign-in. Recently we can across and incident in Sentinel which says "Unfamiliar sign-in properties" but does not show much info...
Rod_Trent
Microsoft
MicrosoftThis may be a situation where the Incident was created before the Entities were added. I've seen this occasionally where it takes a bit for the actual entities to show up, i.e., the Incident is created too quickly. After a time, have you checked back to see if they were added?
Let me know.
Let me know.
- AS always thank you for the quick response rodtrent. Unfortunately incident didn't get update despite being more than 24 hours. But I managed to dig into AAD Identity protection page and find out the alert matching for the incident and also the user account. Now I can safely map them and close the ticket. But I will remember this as an incident where things can happen like this 🙂
