Lesson 24 — Microsoft Entra Workbooks

Learning objectives

After completing this lesson, you should be able to use and customise Microsoft Entra Workbooks for identity monitoring and investigation.

• Explain what Microsoft Entra Workbooks are.
• Open and use built-in workbook templates.
• Understand workbook parameters, queries and visualisations.
• Create a custom workbook from Microsoft Entra KQL.
• Share workbooks securely through Azure RBAC.
• Design useful operational identity dashboards.

Prerequisites

Microsoft Entra logs must be available in a Log Analytics workspace, and the user must have permission to read both the workbook and every resource queried by it.

Creating or saving a workbook requires additional workbook write permissions.

Where to find Workbooks

In the Microsoft Entra admin centre, browse to Entra ID → Monitoring & health → Workbooks.

The gallery groups Microsoft identity templates by scenario, including sign-ins, Conditional Access, multifactor authentication and Identity Protection.

Microsoft Entra and Azure Monitor Workbooks

Microsoft Entra Workbooks use the same underlying Azure Workbooks platform.

The main difference is that the Entra gallery focuses on identity scenarios and provides templates designed around Microsoft Entra telemetry.

Open a gallery template

1. Open the Workbooks gallery.
2. Select a template that matches the investigation.
3. Choose the required subscription and workspace if prompted.
4. Set the time range and other parameters.
5. Review the visualisations and drill into unusual results.

Templates versus saved workbooks

A template is a reusable starting design. A saved workbook is an Azure resource that can be customised, versioned and shared.

Clone or save a template before making changes that should persist.

Workbook parameters

Parameters let users change the workbook without editing its queries.

• Time range
• Subscription
• Workspace
• User or application
• Country or IP address
• Risk level
• Conditional Access result

Why parameters matter

A single parameterised workbook can support many investigations while keeping the underlying KQL consistent.

Parameters also reduce the risk of analysts editing working queries during an incident.

Create a custom workbook

1. Open Workbooks and select New.
2. Add a text heading and investigation instructions.
3. Add a time-range parameter.
4. Add a query component.
5. Select the Log Analytics data source and workspace.
6. Enter and run the KQL query.
7. Choose a visualisation.
8. Save the workbook to a resource group.

First sign-in query

Display this result as a time chart to show changes in sign-in volume.

Failed sign-ins by user

A bar chart or grid makes the highest-volume users easy to identify.

Failures by application

Sign-ins by country

Conditional Access status

Risk-level summary

Top IP addresses

Service principal failures

Choosing the right visualisation

• Use a tile for one important number.
• Use a line chart for change over time.
• Use a bar chart for ranked categories.
• Use a table when exact evidence matters.
• Use maps carefully and only when location adds value.

Keep detailed evidence available

Charts are excellent for spotting patterns, but analysts still need access to timestamps, users, IP addresses, result codes and correlation IDs.

Pair summary visualisations with a detailed evidence table.

Workbook performance

• Use the workbook time-range parameter.
• Filter data early in KQL.
• Avoid returning unused columns.
• Limit large result sets.
• Do not duplicate expensive queries unnecessarily.
• Test performance across realistic time ranges.

Cost considerations

Workbooks query data already stored in Log Analytics, but broad queries and long retention periods contribute to the wider monitoring cost design.

A workbook should help users choose focused time ranges rather than defaulting to months of data.

Sharing and access

Workbook access uses Azure role-based access control.

A user must be able to read the workbook resource and every referenced data source. Editing and saving require workbook write permissions.

Resource group placement

Save operational workbooks in a controlled resource group with clear ownership, naming and change management.

Avoid saving important SOC workbooks into personal or temporary resource groups.

Common workbook mistakes

• Using too many charts on one page.
• Hiding important raw evidence.
• Using unclear titles and labels.
• Failing to expose a time-range parameter.
• Granting workbook access without data-source access.
• Editing a gallery template without saving a controlled copy.
• Building visualisations that do not answer an operational question.

Workbook review checklist

• Does every component answer a useful question?
• Are the data source and time range obvious?
• Can analysts reach the underlying evidence?
• Are parameter defaults safe and efficient?
• Do permissions match the intended audience?
• Is ownership documented?
• Has the workbook been tested with real investigation scenarios?

Security best practices

• Use least privilege for workbook and workspace access.
• Separate operational workbooks from experimental designs.
• Protect sensitive identity and location information.
• Document KQL logic and assumptions.
• Review workbook queries after schema or logging changes.
• Validate visual findings against raw events.