Team: Huntress Managed ITDR / Huntress SIEM
Product: Huntress Managed ITDR, Huntress Managed SIEM
Environment: Microsoft 365, Huntress Platform
Summary: Learn how to monitor sign-ins to emergency-access (break-glass) accounts and review failed sign-in activity. Huntress ITDR does not currently provide a custom alert for every login to a selected identity or a failed login threshold. Use a scheduled Huntress SIEM query to receive periodic notifications, or configure Microsoft Entra sign-in log monitoring in Azure Monitor to trigger an alerting workflow.

Overview

Break-glass accounts are for emergencies only, so most administrators want to know whenever one is used. Huntress Managed ITDR monitors these accounts like any other identity, but it doesn’t currently send a notification for every sign-in to a specific account.

What Huntress Can and Can’t Do

	Huntress Can	Huntress Can’t (Currently)
Break-glass sign-ins	Monitor the account and escalate suspicious activity, such as an unexpected country, session token theft, or malicious datacenter logins	Notify you of every allowed sign-in to a specific account
Failed sign-ins	Store failed, and Conditional Access–blocked sign-ins in the log data you can search with Huntress SIEM	Generate ITDR alerts for failed sign-ins, or alert when failures pass a threshold
Custom alerting	Email the results of a scheduled SIEM query on an interval	Create custom ITDR alert rules, or send real-time notifications from a SIEM query

Huntress doesn’t alert on failed sign-ins because of their volume. A single tenant can generate thousands per day. For more details, see How Entra Conditional Access Policies and Huntress Managed ITDR Work Together.

Choose the monitoring path that fits your response-time, licensing, and cost requirements:

Huntress SIEM scheduled query: A practical workaround that emails query results on a schedule. It is interval-based, not real-time, and does not create a Huntress incident.
Microsoft Entra/Azure Monitor: Microsoft documents how to alert on emergency-access account sign-ins using Entra sign-in logs and Azure Monitor. This requires log routing and an Azure alerting setup; see the licensing and cost notes below.

Option 1: Schedule a Huntress SIEM Query

Use this option to receive periodic results for a specific break-glass account. Replace the example UPN with the account's actual user principal name.

Query successful sign-ins for one account

from logs
| where event.provider == "ITDR"
| where itdr.Operation == "UserLoggedIn"
| where itdr.UserId LIKE "breakglass@yourdomain.com"
| keep event_metadata.logged_time, itdr.UserId, itdr.ClientIP, event.outcome, itdr.Operation

To review failed sign-ins for the account, use a separate query:

from logs
| where event.provider == "ITDR"
| where itdr.Operation == "UserLoginFailed"
| where itdr.UserId LIKE "breakglass@yourdomain.com"
| keep itdr.UserKey, itdr.UserId, client.ip, itdr.LogonError

These are starting points. Huntress SIEM is case-sensitive, and available fields can vary by event. If a query returns no results, confirm the UPN and time range, then compare it with the examples in Starter Queries - Azure Active Directory, Exchange, SharePoint, OneDrive, Teams.

Save and schedule the query

Run the query in the Huntress SIEM Dashboard and confirm that it returns the expected events.
Select Save Query, then enable scheduling and choose an interval.
Choose whether to receive an email when the query returns no results. Turn this off if you only want email when results are found.
Save the schedule and verify the recipient and schedule under SIEM > Query Management.

The query's lookback period matches its schedule interval. For example, a 15-minute interval checks the preceding 15 minutes. When a run completes, an email with a link to the results is sent to the user who configured the scheduled query; account administrators can access exports in the platform.

This workflow is not real-time, does not guarantee immediate delivery, and does not create a Huntress incident. See Manage Queries - Saved and Scheduled Queries.

A scheduled query can help review failed-login activity, but it is not a native ITDR rule for alerting when a configurable count or threshold is crossed. Review the query output and tune the schedule and investigation process to your needs.

Option 2: Configure Microsoft Entra Emergency-Account Monitoring

Microsoft recommends monitoring emergency-access account sign-ins and audit activity, and notifying administrators whenever an account signs in. Its Monitor sign-in and audit logs guidance illustrates this with Azure Monitor; it also identifies Microsoft Sentinel and other monitoring tools as options.

Prerequisites

Send Microsoft Entra sign-in logs to Azure Monitor and select the Log Analytics workspace where they will be queried. See Integrate Microsoft Entra logs with Azure Monitor logs.
Have the appropriate Entra and Azure permissions. Microsoft's steps use at least User Administrator to retrieve account Object IDs and Monitoring Contributor to create the alert rule.
Confirm that the workspace is receiving the expected sign-in events before creating the alert.

Create An Alert For Sign-Ins

In Microsoft Entra ID, go to Users, open each emergency-access account, and copy its Object ID. Microsoft recommends using the Object ID in the example query. For multiple accounts, add an or UserId == "<Object-ID>" condition for each additional account.
In the Azure portal, open Monitor > Alerts > Create > Alert rule. On Scope, select the Log Analytics workspace that receives the Entra sign-in logs.
On Condition, select Custom log search and set Query type to Aggregated logs. Enter a query for the account or accounts:

SigninLogs
| where UserId == "sharkbait-0000-000h-haha-eeeeeeeeeeee"
| project TimeGenerated, UserPrincipalName, UserId, IPAddress, ResultType, ResultDescription

Replace the sample Object ID with the real value. The result fields include the account, IP address, and sign-in result. Microsoft also provides a UPN-based query example in its guidance.

Configure the query's measurement and aggregation. Under Alert logic, use a static threshold of Greater than 0 so a matching sign-in generates an alert, then choose the evaluation frequency that fits your response requirements.
On Actions, select or create an action group and configure the notification recipients and methods (for example, email or SMS). Complete the alert details, enable the rule upon creation, and create it.
Test the rule with a controlled sign-in and confirm the notification reaches the intended responders. Microsoft recommends regularly validating emergency accounts and that monitoring rules trigger at least every 90 days.

The example above alerts on matching sign-in events; it does not distinguish successful from failed sign-ins. If your policy needs different handling by outcome, review the ResultType values and adjust the query and alert criteria. The linked Microsoft workflow's query example is for SigninLogs; if you also need alerts for specific audit events, determine which AuditLogs operations matter and configure a separate, tested rule for them. After an alert, preserve the relevant Entra and other workload logs and review whether the account use was a planned test, an actual emergency, or unauthorized activity.

Licensing and Azure costs

Microsoft's guidance lists Microsoft Entra ID P1 or P2 as a prerequisite for analyzing activity logs with Log Analytics. This is specific to the Log Analytics analysis workflow; sign-in-log viewing and retention differ by license. Confirm the tenant's current entitlement and Microsoft's requirements before recommending this option. See Analyze Microsoft Entra activity logs with Log Analytics.

Azure Monitor and Log Analytics can also incur Azure charges for data ingestion and retention. Review expected volume, retention settings, and the customer's Azure pricing before enabling log routing. See Azure Monitor Logs cost calculations and options.

Frequently Asked Questions

Does Huntress ITDR alert whenever a break-glass account signs in?

No. ITDR may escalate supported suspicious activity, but it does not currently guarantee an alert for every sign-in to a selected identity. Use a scheduled SIEM query to receive periodic results, or configure a separate monitoring workflow in Microsoft Entra/Azure Monitor.

Does Huntress alert on failed sign-ins?

No. Huntress does not generate standalone ITDR alerts for failed logins or logins blocked by Conditional Access. Failed sign-in events can be reviewed in Huntress SIEM, where available; high event volume can make custom monitoring noisy.

Will a scheduled Huntress SIEM query create an incident report?

No. It sends an email with the query results after each scheduled run, based on the schedule and notification settings. It does not create a Huntress incident or provide real-time alerting.

Can I set a threshold for failed logins in Huntress ITDR?

No. Use SIEM queries to review relevant events, or use a Microsoft/third-party monitoring workflow if you need an alerting rule. Validate the capabilities, licensing, and costs of that workflow in the customer's environment.

Monitoring Break-Glass Accounts and Failed Sign-Ins

In This Article