01 / Authentication Testing
Used a dedicated test employee account to generate controlled incorrect-password attempts followed by successful authentication.
NOCTURNE SYSTEMS // NS-IAM-003
IDENTITY THREAT DETECTION & RESPONSE
Authentication Investigation · Conditional Access · Incident Response
01 // EXECUTIVE SUMMARY
Project Overview
This project explores identity security investigation and response using controlled Microsoft Entra ID authentication events and account-containment actions.
I generated test authentication failures, analyzed the resulting logs, evaluated an MFA Conditional Access policy, and carried out a separate simulated account-compromise response drill.
02 // INVESTIGATION WORKFLOW
Detection, Analysis & Response
02 / Sign-in Log Investigation
Examined Microsoft Entra ID sign-in events, including approximately four invalid-credential failures with error code 50126.
03 / Conditional Access Evaluation
Reviewed a report-only MFA policy assigned to all users and resources. The test sign-in evaluation returned User action required.
04 / Account Containment
Performed a separate simulated response drill by disabling the dedicated test account and revoking its authentication sessions.
05 / Recovery
Re-enabled the test account and confirmed its restored account state. Session revocation remained a separate containment action.
03 // AUTHENTICATION FINDINGS
Invalid Credential Events
The controlled test generated approximately four failed authentication log events associated with error 50126, followed by a successful sign-in using the correct password.
ERROR 50126 // Invalid username or password
In this exercise, the activity was authorized and expected. In a real investigation, similar patterns would require additional context such as device consistency, sign-in location, account behavior, and user verification.
04 // CONDITIONAL ACCESS
Report-only MFA Evaluation
The CA-004 policy targeted all users and all resources with a grant control requiring multifactor authentication.
Its state was Report-only, and the evaluated test sign-in showed User action required.
CA-004 // User action required
Because the policy was not enabled for enforcement, this result was a hypothetical policy evaluation, not proof that MFA was enforced during the test.
05 // INCIDENT RESPONSE DRILL
Account Containment & Recovery
As a separate simulated incident-response exercise, I disabled a dedicated test identity, revoked its sessions, and subsequently re-enabled the account.
Blocking sign-in prevents new authentication attempts. Session revocation invalidates supported refresh tokens and sessions, although already-issued access tokens may remain usable until expiration or other enforcement.
This drill did not respond to a confirmed compromise. It demonstrated administrative containment and account-state recovery within an authorized lab.
06 // EVIDENCE ARCHIVE
Full Technical Report
The complete report documents authentication evidence, Conditional Access analysis, controlled account containment, and recovery screenshots.
07 // LESSONS LEARNED
Key Takeaways
This exercise strengthened my understanding of sign-in investigations, authentication error interpretation, report-only Conditional Access policies, session revocation, account containment, and incident response decision-making.
Authorized lab exercise. Authentication failures were intentionally generated. The containment scenario was simulated. No genuine attacker activity or confirmed compromise was identified.