User Investigation — Credential Compromise Assessment
The prompt
In Microsoft Entra ID, investigate user [UPN or display name]. For the last 72 hours: 1. List all sign-in events. For each: timestamp, location, IP address, device, application, risk level, and outcome (success/failure/interrupted) 2. Flag any sign-ins from new locations, new devices, or impossible travel scenarios 3. Were any MFA prompts denied or bypassed? 4. Were any privileged roles assigned or modified on this account in this period? Return a table of sign-in events sorted by timestamp. Highlight high-risk events in bold.
How to use it
- 1Select Copy the prompt above.
- 2Paste it into Microsoft 365 Copilot.
- 3Replace anything in brackets with your own detail, then send it.
Copilot gathers and drafts. You verify and decide. Check every figure, name and date against the system it came from before you act on it.
Written for
SOC Analyst L2, Identity Security Analyst
More for Microsoft Copilot for Security
- First Look — Incident Summary
- Alert Triage — Is This a True Positive?
- Multi-Alert Correlation — Single Incident Thread
- Device Investigation — Rapid Scope
From the source collection in awesome-microsoft-copilot-prompts, licensed CC BY-SA 4.0.