Microsoft identity
Entra ID, Conditional Access, administrative access and the controls that determine how people and services authenticate.
Microsoft cloud security engineering
Security can fail without making a sound.
We investigate the space between what your Microsoft environment says is enabled and what the evidence shows is working.
Discuss your environmentSee the engineering behind our workConfiguration is a claim.Evidence is an answer.
A point of view
The most important security question is often the one nobody thought to ask.
Are the logs actually arriving? Will that detection ever fire? Could a privileged account be exposed without anyone noticing?
These are not abstract concerns. They are engineering questions, answerable through investigation, careful configuration and honest verification.
From our Microsoft security lab
The connector was enabled. The expected logs never came.
We encountered a missing Entra ID telemetry path while configuring Microsoft Sentinel in our own environment. The investigation led to diagnostic export settings, not to another analytics rule.
Read the investigationAn internal technical case study, not a client engagement.
An observation worth keeping
“Enabled” described the connector.
It did not describe the data.
Where we work
Identity. Visibility. Detection.
Explained with evidence.
Sentinel and telemetry
Log routing, expected event sources, ingestion gaps and the monitoring dependencies that are easy to overlook.
Detection engineering
KQL, selected analytics rules, controlled validation and documented limitations. A rule that exists is not automatically one that works.
Start a conversation
Tell us what you cannot quite see.
We will help you clarify the question before suggesting a solution.
Email Secure Scale Systemshello@securescalesystems.com