Guides

Longer walkthroughs that combine several error codes into one investigation.

• How to detect MFA fatigue (push bombing) in Microsoft Entra ID: Detect MFA fatigue in Entra ID: read 500121, 50074, 50076 and 50079, parse AuthenticationDetails with KQL, spot an approved prompt, and respond.
• How to detect password spraying in Microsoft Entra ID (with KQL): Find password spraying in Entra ID sign-in logs: which AADSTS codes to read, how smart lockout behaves, four KQL queries, and how to respond.
• How to investigate consent phishing (illicit consent grants) in Entra ID: Find the consent event, read the sign-in codes around it, and remove an attacker's app from Entra ID. Why a password reset and MFA don't fix it.
• After a compromise: revoke Entra ID sessions and prove it worked: Revoke a compromised user's Entra ID sessions, disable their devices, and use 50173, 50133 and 135011 sign-in rows to prove the attacker was cut off.