Unfamiliar sign-in properties does not show more information in Sentinel

%3CLINGO-SUB%20id%3D%22lingo-sub-2728502%22%20slang%3D%22en-US%22%3EUnfamiliar%20sign-in%20properties%20does%20not%20show%20more%20information%20in%20Sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2728502%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20have%20already%20setup%20CA%20policies%20with%20strict%20policies%20when%20it%20comes%20to%20sign-in.%20Recently%20we%20can%20across%20and%20incident%20in%20Sentinel%20which%20says%20%22Unfamiliar%20sign-in%20properties%22%20but%20does%20not%20show%20much%20information%20in%20the%20incident.%20Need%20to%20check%20with%20forum%20members%20if%20this%20is%20expected%20scenarios%20for%20others%20as%20well.%20Kindly%20refer%20to%20the%20attach%20picture%20for%20more%20information.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2728752%22%20slang%3D%22en-US%22%3ERe%3A%20Unfamiliar%20sign-in%20properties%20does%20not%20show%20more%20information%20in%20Sentinel%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2728752%22%20slang%3D%22en-US%22%3EThis%20may%20be%20a%20situation%20where%20the%20Incident%20was%20created%20before%20the%20Entities%20were%20added.%20I've%20seen%20this%20occasionally%20where%20it%20takes%20a%20bit%20for%20the%20actual%20entities%20to%20show%20up%2C%20i.e.%2C%20the%20Incident%20is%20created%20too%20quickly.%20After%20a%20time%2C%20have%20you%20checked%20back%20to%20see%20if%20they%20were%20added%3F%3CBR%20%2F%3E%3CBR%20%2F%3ELet%20me%20know.%3C%2FLINGO-BODY%3E
Occasional Contributor

We have already setup CA policies with strict policies when it comes to sign-in. Recently we can across and incident in Sentinel which says "Unfamiliar sign-in properties" but does not show much information in the incident. Need to check with forum members if this is expected scenarios for others as well. Kindly refer to the attach picture for more information. 

2 Replies
This may be a situation where the Incident was created before the Entities were added. I've seen this occasionally where it takes a bit for the actual entities to show up, i.e., the Incident is created too quickly. After a time, have you checked back to see if they were added?

Let me know.
AS always thank you for the quick response rodtrent. Unfortunately incident didn't get update despite being more than 24 hours. But I managed to dig into AAD Identity protection page and find out the alert matching for the incident and also the user account. Now I can safely map them and close the ticket. But I will remember this as an incident where things can happen like this :)