Event-Driven Threat Detection: Building Real-Time Security on Conditional Access Gaps

In the previous post, we identified three key gaps that Conditional Access cannot address: Brute force patterns (e.g. 10 failures in 2 minutes) Activity from excluded users (e.g. executives bypassing geo-blocking) behavioural anomalies (e.g. Saturday midnight logins) This post builds the detection layer that catches what CA misses. Not prevention but detection. Stream Analytics complements Conditional Access, not replaces it. What this system detects : Brute force patterns (5+ failures in 10-minute windows) Geographic anomalies from excluded users (non-UK access with no CA oversight) behavioural anomalies (off-hours activity from UK locations) What this system does NOT detect : Token theft without anomalous sign-in activity Lateral movement after successful authentication Data exfiltration post-login This highlights a critical principle: identity security requires both preventative controls (Conditional Access) and detective controls (event-driven monitoring). Note: This is about detec