Topic starter
22/08/2026 12:00 pm
TL;DR: A large Azure exfiltration campaign shows how compromised Entra ID identities, partial telemetry, and costly log routing can let attackers move data out of tenants without timely detection, according to DataBahn. The real failure is not logging existence but telemetry completeness, coverage mapping, and queryable evidence when identity data is already in motion.
Editorial analysis by NHI Mgmt Group, based on content published by DataBahn: “Inside Azure Exfiltration: The Identity Telemetry Gap”.
Key questions
Q: What breaks when Entra ID telemetry does not reach detection completely?
A: The control breaks because defenders lose the ability to correlate identity events into a reliable attack picture.
Q: Why do partial logs create such a large exfiltration risk in Azure?
A: Because identity-led exfiltration often depends on the combination of sign-in, token, and export evidence rather than any single alert.
Q: What do security teams get wrong about identity telemetry?
A: They often use telemetry to report outcomes instead of to explain failure.
Practitioner guidance
- Define detection coverage for Entra ID techniques Map the specific identity techniques you expect to detect, then verify which log sources actually reach those detections right now.
- Validate telemetry completeness in-stream Check for dropped fields, truncation, and delivery lag before identity events are transformed or forwarded to downstream tools.
- Make identity export events queryable in one path Ensure sign-in logs, bulk export activity, and session evidence can be searched together without manual rehydration or separate access requests.
Bottom line: Compromised Entra ID identities can turn Azure directory exports into a high-blind-spot exfiltration path when telemetry is only partially visible.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/08/2026 12:02 pm
Telemetry completeness is now an identity governance control, not a logging preference. If Entra ID events do not reach detection with full fidelity, the organisation does not have operational visibility no matter how many collectors are configured. This is especially true when identity data is already moving inside the tenant and the window for response is measured in minutes. Practitioners should treat coverage and completeness as governance outcomes, not infrastructure settings.
A question worth separating out:
Q: What should organisations do when tenant identity data is exposed through export activity?
A: They should immediately confirm which export events occurred, which identities were used, and whether downstream telemetry still contains the evidence needed for scoping. The priority is to rebuild the timeline from surviving identity records, then close the coverage gap that allowed the export to remain invisible.
👉 Read our full editorial: Azure identity telemetry gaps turn exfiltration into a blind spot