Enabling KQL Query for the risky users without Entra ID Premium P2?

Question

Does the Entra ID Premium P2 required to be able to query the risky users with KQL (Kusto) and then send the email alert to the relevant team?

Thank you in advance for any help and suggestions.

Answer 1

That's correct. Entra ID Premium P2 is required to query risky users and utilize advanced security features, including Identity Protection, which identifies and reports risky users. This premium tier provides the capabilities necessary to detect and respond to identity-based threats within your organization.

With Entra ID Premium P2, you can access advanced features like:

1. Risky Users Detection: Identifying and flagging users with suspicious activities or compromised credentials.
2. Kusto Query Language (KQL): Running custom queries against the identity protection logs to retrieve detailed information about risky users.
3. Automated Responses: Setting up alerts and automated workflows, such as sending email alerts to the relevant team when risky user activity is detected.

Details at https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin