Behaviour signals
Keepnet + Entra ID Protection integration
Bring risky sign-ins into the behaviour record.
Signals in
Keepnet integrates with Entra ID Protection to bring risky sign-ins into the behaviour record.
What you get
- Identity risk detections linked to the employee
- Sign-in and directory audit logs, if you want them
- Risky sign-ins can trigger a nudge in Teams
How it works
- Keepnet reads the riskDetections feed
- Detections are matched to employees
- The behaviour is recorded with a severity
Data and permissions
| Data | Direction | Detail |
|---|---|---|
| Risk detections | In | Read only (IdentityRiskEvent.Read.All) |
| Sign-in logs | In | Optional, turned on in the connection |
| Directory audit logs | In | Optional |
What you need
- Admin consent
Set up
Connect your tenant and choose the log types to read.
Related integrations
- Works with
- Secure Behaviour Dashboard, Agentic AI
- Built by
- Keepnet
- Last updated
- October 2026
