Forum Discussion
Unfamiliar sign-in properties does not show more information in Sentinel
We have already setup CA policies with strict policies when it comes to sign-in. Recently we can across and incident in Sentinel which says "Unfamiliar sign-in properties" but does not show much info...
Rod_Trent
Microsoft
MicrosoftThis may be a situation where the Incident was created before the Entities were added. I've seen this occasionally where it takes a bit for the actual entities to show up, i.e., the Incident is created too quickly. After a time, have you checked back to see if they were added?
Let me know.
Let me know.
AS always thank you for the quick response rodtrent. Unfortunately incident didn't get update despite being more than 24 hours. But I managed to dig into AAD Identity protection page and find out the alert matching for the incident and also the user account. Now I can safely map them and close the ticket. But I will remember this as an incident where things can happen like this 🙂