Topic starter
22/08/2026 12:00 pm
TL;DR: Compromised Entra ID identities can make Azure directory exports hard to spot when telemetry stays only partly visible, with DataBahn noting the detection gap. Identity monitoring loses its value when events do not arrive with enough fidelity to support correlation and timely investigation.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “Inside Azure Exfiltration: The Identity Telemetry Gap”.
Key questions
Q: Why do partial logs create such a large exfiltration risk in Azure?
A: Because identity-led exfiltration often depends on the combination of sign-in, token, and export evidence rather than any single alert.
Q: What do security teams get wrong about identity telemetry?
A: They often use telemetry to report outcomes instead of to explain failure.
Q: What breaks when Entra ID telemetry does not reach detection completely?
A: The control breaks because defenders lose the ability to correlate identity events into a reliable attack picture.
Practitioner guidance
- Define detection coverage for Entra ID techniques Map the specific identity techniques you expect to detect, then verify which log sources actually reach those detections right now.
- Validate telemetry completeness in-stream Check for dropped fields, truncation, and delivery lag before identity events are transformed or forwarded to downstream tools.
- Make identity export events queryable in one path Ensure sign-in logs, bulk export activity, and session evidence can be searched together without manual rehydration or separate access requests.
Bottom line: Compromised Entra ID identities can turn Azure directory exports into a high-blind-spot exfiltration path when telemetry is only partially visible.
Glossary terms: Telemetry Completeness Validation, Coverage mapping, Directory export visibility, Queryable evidence
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
22/08/2026 12:02 pm
Telemetry completeness is now an identity governance control, not a logging preference. If Entra ID events do not reach detection with full fidelity, the organisation does not have operational visibility no matter how many collectors are configured. This is especially true when identity data is already moving inside the tenant and the window for response is measured in minutes. Practitioners should treat coverage and completeness as governance outcomes, not infrastructure settings.
A question worth separating out:
Q: What should organisations do when tenant identity data is exposed through export activity?
A: They should immediately confirm which export events occurred, which identities were used, and whether downstream telemetry still contains the evidence needed for scoping. The priority is to rebuild the timeline from surviving identity records, then close the coverage gap that allowed the export to remain invisible.
👉 Read our full editorial: Azure identity telemetry gaps turn exfiltration into a blind spot