Selected work
Here is a problem we actually encountered.
An investigation inside our own Microsoft security environment, drawn from our 2026 internal engineering assessment.
Technical case study
When the expected signal is missing.
Microsoft Sentinel and Entra ID telemetry, investigated in an internal lab environment.
This case is not presented as an external client outcome. The original assessment is confidential and is not published here.
Follow the investigation
The controls appeared in place, but the evidence did not.
Expected sign-in and audit log data was not appearing in the intended Log Analytics workspace. The presence of a connector did not establish that the data path was working.
Observation: configured components and absent expected telemetry.
What the work informed.
Our internal 2026 assessment also documented work with Conditional Access, identity management, KQL detection queries, Sentinel analytics and incident-handling automation.
The assessment is a historical technical record. We do not treat it as evidence that every licence, policy or detection remains operational today, and we do not treat empty query results as proof of an absence of risk.
Our public technical library contains policy examples, detection queries and supporting engineering notes. Customers should review prerequisites and test these materials before using them.
Explore our GitHub resources