Entra ID Audit Logs
AssessTools
Microsoft audit and sign-in logs used to track when a user last authenticated.
Why it's here
Placed in Assess: 1 article(s) of evidence from 1 source(s), led by security coverage, with 1 in the last 30 days. Confidence 24%. Low accumulated evidence, so it defaults conservatively pending more signal.
Evidence (1)
- 5The New Stack·9/29/2026securityQuerying stale resource ownership before it becomes a security issue
The article proposes a practical way to detect when infrastructure resource ownership has gone stale after a promotion, team change, or departure. It suggests using identity login or access logs in AWS, Microsoft Entra ID, and Google Workspace to flag owners who have been inactive for 90 days and trigger a review or reassignment process.