Part 2 of the real-time Entra ID series. Stream sign-in logs through diagnostic settings to an Event Hub, consume them in the same Azure Function App, and page on duty the moment a break-glass UPN signs in or sign-in risk crosses a threshold.

read more