Most engineers think…
Most people treat UEBA as another alert rule — 'turn it on and it will fire when something bad happens'. That framing fails in an interview and in a real SOC shift.
Microsoft Sentinel UEBA is a behavioural context layer, not an alert engine. It builds a baseline for every entity, scores deviations relative to that entity's own history and its peer group, weights the score by the entity's blast radius, and surfaces the result as entity insights alongside your existing incidents. Understanding the score — not just reacting to it — is what makes the difference between a 3-hour investigation and a 30-minute one.
① What Microsoft Sentinel UEBA actually is — a behavioural context layer
Sentinel UEBA ingests logs and alerts from your connected data sources and runs machine learning to build behavioural profiles for each entity: users, hosts, IP addresses and applications. The key word is baseline — Sentinel learns what normal looks like for that specific entity before it flags anything as anomalous.
When an entity's behaviour deviates from its own baseline, Sentinel writes an anomaly record to the BehaviorAnalytics table. It also checks whether the deviation is unusual compared to the entity's peer group. If the same action is common among peers, the weight of the anomaly is reduced. If even the peers rarely do it, the signal is stronger.
UEBA does not fire an incident on its own. It enriches existing incidents and provides a prioritised entity view so the SOC can decide where to start. The April 2026 Behaviours Layer adds a further layer: aggregating sequences of events into meaningful behavioural patterns mapped to MITRE ATT&CK, with explainability built in.
Microsoft Sentinel UEBA is best described as…
② Enabling UEBA — data sources, permissions and the toggle
To turn on UEBA, navigate to Microsoft Sentinel > Settings > Entity behaviour analytics and switch it on. You need at least Microsoft Sentinel Contributor on the workspace and the workspace must already have data connectors feeding it. UEBA then needs time — typically a 7-day learning period — before it can reliably score deviations.
Which data sources matter most
UEBA draws on several sources. Microsoft Entra ID sign-in logs are the richest signal for user behaviour. Microsoft Defender XDR device logon events cover host activity. As of September 2025, six new sources were added: Microsoft authentication sources, Entra managed identity sign-in logs, and others. Sentinel also enriches entities with Entra ID intelligence — job title, department, manager, group membership and MFA status — so the peer analysis algorithm has organisational context to work with, not just raw log counts.
Once enabled, UEBA populates three key tables: BehaviorAnalytics (per-entity anomaly records), UserPeerAnalytics (top ranked peers per user), and IdentityInfo (Entra context). These are queryable in Log Analytics and surface automatically in the investigation pane.
The primary UEBA output table. Each row is one anomaly record for one entity, with the investigation priority score, anomaly type, and contributing evidence. Query it in Log Analytics for hunting.
Sentinel ranks the most similar users using a TF-IDF-style algorithm on role, department, location and access pattern. A deviation rare among peers weighs more than one common to the group.
A measure of how much organisational damage an entity could cause — based on role, group membership, privileges, hierarchy and access to sensitive resources. A Global Admin always has high blast radius.
The investigation UI surface: shows the priority score, top-3 anomalies from the past 30 days, Entra ID context, and a peer comparison chart. Available in the Defender portal incident view.
UEBA needs at least a week of baseline data before scores are meaningful. If you enable it and immediately see low scores on suspicious users, the model has not yet learned normal. Check the 'Entity behaviour analytics' status blade to confirm baselining is complete before using scores in triage.
Which table stores per-user peer rankings used in UEBA scoring?
③ Investigation priority score — peer analysis, blast radius and the 0-10 scale
Every UEBA-enriched entity gets an investigation priority score between 0 and 10. The score is not simply a count of anomalies — it combines three signals: the entity's deviation from its own baseline, its deviation from its peer group, and its blast radius.
Peer analysis uses a TF-IDF-style algorithm to rank the users most similar to a given entity by job role, department, location and access pattern. If a user is doing something their peers all do routinely, the anomaly weight is reduced. If the action is rare even among peers, the weight increases. This is the mechanism that separates a genuine insider threat signal from a noisy outlier on a single rule.
Blast radius weighting
Blast radius gauges how much organisational damage an entity could cause — a Global Admin with access to all Azure resources scores much higher blast radius than a read-only guest. The score factors in role, group memberships, privileges, management hierarchy and access to sensitive resources. A mid-level deviation by a privileged account therefore outranks a large deviation by a low-privilege account. Scores of 6–10 should be investigated within hours; 3–5 warrant a same-shift review; 0–2 indicate near-normal activity.
A 9/10 deviation on a read-only guest with no sensitive access can produce a lower priority score than a 4/10 deviation on a Global Admin. Forgetting blast-radius weighting causes you to chase noisy, low-risk outliers and miss the real threat buried in the privileged account list.
▶ Watch a compromised admin account get scored and surfaced
How UEBA detects, scores and surfaces a credential-compromise scenario end-to-end. Press Play for the healthy detection path, then Break it to see the classic failure.
A global admin performs an action with a deviation score of 4/10, while a read-only guest has a deviation score of 7/10. Which entity gets a higher investigation priority score and why?
④ Entity insights and anomalies — the investigation path
In the Microsoft Defender portal (where Sentinel now surfaces UEBA experiences as of late 2025 preview), analysts open an incident and see an Entity insights pane for each linked user or host. It shows the investigation priority score, the top three anomalies from the past 30 days, the entity's peer group, and Entra ID context. Users with active behavioural anomalies are tagged with a UEBA Anomalies badge so triage is visual.
Clicking an entity opens the full entity page: a timeline of all activity, each event colour-coded by anomaly weight, and a peer comparison chart showing how unusual the action was relative to peers. For a lateral-movement investigation this is decisive — you can see at a glance that the user accessed three new hosts and downloaded 400 MB, actions their entire peer group almost never performs.
For threat hunting, query BehaviorAnalytics directly — filter on InvestigationPriority >= 6, join to IdentityInfo for the user's department, and pivot to UserPeerAnalytics to check peer scores. The combination surfaces high-confidence, high-impact leads without writing a single custom detection rule.
Priya, a SOC analyst at a Pune-based fintech, faces this
Priya's morning Sentinel dashboard shows 200 new incidents. One mentions a finance manager, Ravi, whose account triggered a medium-severity alert for an unusual sign-in time. Buried in the pile, Priya almost skips it.
Without UEBA context, all 200 incidents look equally urgent. The sign-in time rule fires for shift workers too, so there's no fast way to know if Ravi is genuinely suspicious or just working late.
Priya opens the entity insight pane for Ravi: investigation priority score 8/10. Three anomalies flagged — new country login, first-time access to the Azure Key Vault, and 2 GB download from SharePoint — all in the same 90-minute window. Ravi's peer group of 12 finance managers has zero similar events. Blast radius: high (finance admin role with Key Vault access).
Sentinel Incident ▸ Entity Insights ▸ Ravi ▸ BehaviorAnalytics ▸ UserPeerAnalyticsPriya immediately suspends Ravi's account, opens a formal IR ticket, and checks Key Vault access logs. Turns out credentials were phished. Total time from incident to suspension: 18 minutes, because entity insights made the priority obvious.
After the IR: UEBA anomaly records confirm the three-event sequence; peer comparison shows zero similar events in the peer group in 6 months. The investigation priority score correctly ranked this above 180 lower-risk incidents.
The investigation priority score is the headline, but the peer comparison chart is the evidence. Before escalating, open the entity page and confirm the flagged actions are genuinely rare among peers — this single step cuts false escalations and gives you defensible evidence for the IR report.
You want to hunt for high-confidence insider-threat leads without writing custom detection rules. What is the most direct approach in Sentinel?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: what does the investigation priority score actually measure — and why can a smaller raw deviation on one user score higher than a larger deviation on another? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- UEBA (User & Entity Behaviour Analytics)
- A Microsoft Sentinel feature that baselines entity behaviour using ML, scores deviations, and enriches incidents with investigation priority scores and entity insights.
- Investigation priority score
- A 0–10 score per entity combining deviation from own baseline, deviation from peer group, and blast-radius weighting. 6–10 = urgent investigation.
- Blast radius
- The potential organisational damage an entity could cause, assessed from role, group membership, privileges, hierarchy and access to sensitive resources.
- BehaviorAnalytics table
- The primary UEBA output table in Log Analytics — each row is one anomaly record with the priority score, anomaly type, and contributing evidence.
- UserPeerAnalytics table
- Stores the highest-ranked peer users for each entity, produced by Sentinel's TF-IDF peer-ranking algorithm on role, department, location and access patterns.
- IdentityInfo table
- Entra ID context table — job title, department, manager, group membership, MFA status and licences — used by UEBA for peer analysis and blast-radius scoring.
- Peer analysis
- A TF-IDF-style algorithm that ranks similar users and determines whether an action is rare among peers, amplifying or dampening the anomaly weight accordingly.
- Behaviours Layer
- A 2026 UEBA expansion that aggregates event sequences into meaningful behavioural patterns mapped to MITRE ATT&CK, adding explainability to UEBA detections.
- Entity insights pane
- The Defender portal UI surface showing the priority score, top-3 anomalies, Entra ID context, and peer comparison chart for each entity linked to an incident.
- UEBA Anomalies tag
- A badge applied to entities in the Defender portal when they have active behavioural anomalies, enabling visual triage across the incident queue.
📚 Sources
- Microsoft Learn — Advanced threat detection with UEBA in Microsoft Sentinel. learn.microsoft.com/en-us/azure/sentinel/identify-threats-with-entity-behavior-analytics
- Microsoft Learn — Enable entity behaviour analytics to detect advanced threats. learn.microsoft.com/en-us/azure/sentinel/enable-entity-behavior-analytics
- Microsoft Learn — Microsoft Sentinel UEBA reference (BehaviorAnalytics, UserPeerAnalytics, IdentityInfo tables). learn.microsoft.com/en-us/azure/sentinel/ueba-reference
- Microsoft Tech Community — Introducing Investigation Priority built on UEBA. techcommunity.microsoft.com/blog/microsoft-security-blog/introducing-investigation-priority-built-on-user-and-entity-behavior-analytics
- Microsoft Sentinel Update — New data sources for enhanced UEBA (September 2025). devicebase.net/en/microsoft-sentinel/updates/new-data-sources-for-enhanced-user-and-entity-behavior-analytics-ueba
- Microsoft Sentinel Update — New UEBA experiences in the Defender portal (Preview, November 2025). devicebase.net/en/microsoft-sentinel/updates/new-entity-behavior-analytics-ueba-experiences-in-the-defender-portal-preview
What's next?
Got UEBA down? Next, explore Microsoft Sentinel Analytics rules and how custom KQL detections combine with UEBA scores to surface high-fidelity, context-rich incidents.