Recommended Free Tools
Detect suspicious new employee accounts by establishing which systems and people are allowed to create them, then correlating account audit and provisioning events with sign-ins, access changes, and risk signals. An account created outside the approved onboarding path, granted unexpected privileges, or used from an unusual context deserves investigation—but no single signal proves compromise.
The concrete event examples below are for Microsoft Entra ID. Other identity platforms use different event names and fields, so adapt the logic to your environment.
As an Amazon Associate I earn from qualifying purchases.
Define what normal account creation looks like
Build the baseline before writing alerts. Record the approved identity sources—such as an HR system or managed directory—and the people, services, and workflows permitted to create or delete accounts. Document expected naming formats, directory attributes, onboarding windows, locations and egress IPs, and the access each employee group needs.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsAlso establish expected authentication and MFA behavior. Microsoft’s Microsoft Entra security operations for user accounts advises defining normal behavior first. Thresholds should reflect your organization’s observed activity; the guidance does not establish a universal failure-count or MFA threshold.
#1 Best Overall
- Box of 100 Units
Which logs answer which questions?
| Log or context | What it can establish |
|---|---|
| Identity audit logs | What account or directory changes occurred, who initiated them, and which identity was targeted. Microsoft account-operations guidance |
| Provisioning logs | What the provisioning service did to a user object, including creation, updates, and deletion. Microsoft recommends these logs for actions performed by the provisioning service. Microsoft Entra audit log activity reference |
| Provisioning-configuration audit events | Whether an automated provisioning configuration was created, changed, paused, disabled, or restarted. Microsoft Entra audit log activity reference |
| Sign-in logs | Whether an identity authenticated and the available location, device, application, and access-policy context. Microsoft account-operations guidance; Microsoft interactive sign-ins reference |
| Risk and privileged-account context | Whether a risk signal, unexpected privilege, or sign-in deviation warrants higher-priority review. Microsoft Entra security operations for privileged accounts |
| Central monitoring or SIEM | Whether events can be correlated, alerted on, and retained beyond the source platform’s configured window. Microsoft account-operations guidance; CISA SCuBA guidance |
Trace each account from creation to first use
1. Inspect account creation and deletion
In Microsoft Entra audit activity, review successful user-add and user-delete events. Identify the initiator and target account, then compare the actor and source with your approved provisioning list. Check whether the account’s domain and attributes fit the onboarding process.
Microsoft recommends looking for successful user-add and user-delete events close together; its guidance gives deletion within 24 hours as an example hunting interval. A short-lived account might have been used and removed before it drew attention, but it could also point to an overly broad provisioning permission or a legitimate correction. Treat the pattern as a lead to investigate, not proof of malicious activity. Microsoft Entra security operations for user accounts
Rank #2
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
2. Check what the provisioning service did
Use provisioning logs to determine whether an automated service created, updated, or deleted the user object. Separately, inspect audit events for changes to the provisioning configuration itself. A routine HR-driven account creation and an unexpected change that enables, pauses, or restarts automation are different explanations and should be investigated separately. Microsoft Entra audit log activity reference
3. Review sign-ins and early access
Look for interactive and non-interactive sign-in activity as appropriate. Check whether the account should have access at all, then compare its location, IP, device, browser, application or resource, Conditional Access result, and risk context with the user’s expected behavior. The interactive sign-in reference describes location, Conditional Access application, and cross-tenant access details among the available information. A successful authentication does not by itself establish that the account or access is legitimate. Microsoft interactive sign-ins reference
Rank #3
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Microsoft notes that, as of April 11, 2025, new sign-ins that obtain a refresh token using FIDO2 keys are logged in non-interactive sign-in logs. Account for that behavior when deciding which sign-in stream to examine. Microsoft interactive sign-ins reference
4. Correlate privileges, authentication changes, and risk
Check whether the new account received unexpected group membership or role assignments, credential changes, or authentication-method changes. Compare resource access with the employee’s onboarding needs. For privileged identities, scrutinize sign-in failures, risk state, location, device, MFA, password changes, and activity outside expected controls; apply your own thresholds rather than assuming a universal cutoff. Microsoft Entra security operations for privileged accounts
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C & NFC): The Thetis PRO-A features integrated USB Type C and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Compare competing explanations before escalating
Use the same investigation axes for each account rather than treating one alert as a verdict:
- Creator and source: approved provisioning actor and source, or an unapproved one?
- Account details: expected naming and attributes, or a mismatch?
- Automation: routine provisioning action, or a provisioning-configuration change?
- Access: appropriate for the employee’s role and onboarding stage, or broader than expected?
- Account sensitivity: ordinary employee identity, or one with privileged access?
- Sign-in context: consistent with the baseline, or unusual for location, device, application, policy result, or risk?
These comparisons help prioritize review; none alone establishes malicious intent. An unusual event may have a legitimate explanation, while several individually ordinary events can become concerning when they form an unexpected sequence.
Best Value
- 𝟱𝟬 𝗣𝗔𝗖𝗞 𝗢𝗙 𝗖𝗔𝗥𝗗𝗔𝗖𝗖𝗘𝗦𝗦 𝗖𝗔𝗥𝗗𝗦: Format H10301, 125 kHz Prox card frequency, replaces 1326 & 1386 HID door access cards
- 𝗦𝗔𝗠𝗘 𝗗𝗔𝗬 𝗖𝗨𝗦𝗧𝗢𝗠 𝗘𝗡𝗖𝗢𝗗𝗘𝗗 𝗖𝗔𝗥𝗗𝗦: Card number range & Facility code
- 𝗖𝗔𝗥𝗗 𝗥𝗔𝗡𝗚𝗘 𝗡𝗨𝗠𝗕𝗘𝗥: Printed on each card
- 𝗣𝗥𝗜𝗡𝗧𝗔𝗕𝗟𝗘 𝗢𝗡 𝗕𝗢𝗧𝗛 𝗦𝗜𝗗𝗘𝗦 𝗪𝗜𝗧𝗛 𝗜𝗗 𝗖𝗔𝗥𝗗 𝗣𝗥𝗜𝗡𝗧𝗘𝗥: Fargo, Zebra, Evolis, Datacard & Magicard printers (NOT INKJET)
- 𝗙𝗜𝗥𝗦𝗧 𝗧𝗜𝗠𝗘 𝗕𝗨𝗬𝗘𝗥𝗦: 𝗢𝗡𝗘 𝗖𝗔𝗥𝗗 𝗪𝗜𝗟𝗟 𝗕𝗘 𝗦𝗘𝗡𝗧 𝗢𝗡 𝗗𝗔𝗬 𝗢𝗙 𝗢𝗥𝗗𝗘𝗥. After you verify it works with your system, we will send the rest of your order. Instructions included in box.
Preserve evidence and tune monitoring
Keep the lifecycle event, actor and target, provisioning details, sign-in context, access changes, and timestamps together so investigators can reconstruct the sequence. Export relevant streams to a monitored destination when you need centralized correlation or retention beyond the source platform’s configured period.
Microsoft’s account-operations guidance describes 30-day audit-log retention and recommends exporting logs to Azure Monitor or a SIEM for longer-term retention. Confirm the actual retention setting in your tenant and destination; it can vary with configuration. CISA’s SCuBA diagnostic-logging guidance lists identity-related streams such as AuditLogs, SignInLogs, RiskyUsers, UserRiskEvents, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, and MicrosoftGraphActivityLogs. That list is a collection reference, not a universal event schema. Microsoft Entra security operations for user accounts; CISA SCuBA guidance
If evidence suggests unauthorized creation or use, follow your organization’s incident process to contain access, preserve evidence, and verify whether the approved onboarding source or privileged provisioning path was changed. The cited guidance supports monitoring and escalation but does not prescribe one containment sequence for every organization.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Adapt the detections to your identity platform
Microsoft Entra’s event names, available fields, licensing, retention, and export options can vary by tenant and change over time. Verify current platform documentation and local configuration before deploying rules. For another identity provider, preserve the investigation logic—approved origin, lifecycle sequence, automation changes, access grants, and authentication context—while mapping each question to that platform’s logs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
