ProveEvidence

Privileged Login Review

Reads the week's admin sign-ins and highlights anything off-pattern, such as a new country or VPN exit.

Part of Privileged access review

Tools

Microsoft Sentinel, Microsoft Entra ID, Slack

Outcomes

Off-pattern admin logins listed • New locations highlighted • Findings routed to the security queue

Documentation

Instruction-ready detail below

<in:schedule>Every Friday at 4pm</in:schedule>, pull the week's admin sign-ins, flag any from a country or address not seen before, and <slack>post</slack> the short list for review.

Instruction file

<in:schedule>Every Friday at 4pm</in:schedule>, pull the week's admin sign-ins, flag any from a country or address not seen before, and <slack>post</slack> the short list for review.

Setup requirements

Tools

Microsoft Sentinel, Microsoft Entra ID, Slack

Trigger

Every Friday at 4:00pm

Setup time

30 minutes

Other automations in this workflow

Access Review Evidence Pack

Bundles the decisions, the releases and the removal confirmations into one exportable record.

Elevation Expiry Check

Lists standing admin grants older than 30 days and drafts the release request for the named owner.

Just-In-Time Admin Request

Turns a break-glass request into a time-boxed elevation with a recorded reason and an automatic expiry.

Related workflows

Access reviews

Works the periodic entitlement list so access nobody still needs is released, and every decision is written down.

Joiner, mover and leaver access

Grants, adjusts and removes application access from one approved people record, so nothing survives a leaver.

Audit trails

Joins the scattered administrative change records into one timeline, so an auditor's question is a search rather than a fortnight of exports.

Download

Start with one instruction file.

Download the app and begin with drafts and checklists before you write anything back.

  • •Plain-language instructions
  • •Runs on your machine
  • •Works with your existing setup
  • •Reviewable activity history
Download