Entra risk and MFA data — P2 licensing notes
Review the Entra ID P2 feature gaps described for sign-in risk data, MFA investigation and risk-based Conditional Access. The query is conditional on the recorded licensing assumptions.
Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
Recorded licensing gap
Effect described for KQL and MFA investigation
The source reports missing risk/MFA investigation data in an environment without Microsoft Entra ID P2. It does not confirm the current tenant licence or available tables.
The source attributes these Advanced Hunting gaps to the missing P2 licence:
- not have a table called: GraphApiAuditEvents
- have columns missing in: EntraIdSignInEvents table with no data in the "Risk State","RiskDetails" and "RiskLevekAggregated" columns
- No access to Risk-based Conditional Access polices
Reference: See Entra Authentication Features to License comparison table
Query conditional on the recorded P2 dependency
The source presents this KQL as an example conditional on P2 licensing. It suggests that direct risk fields would simplify its larger query, where missing data was only partly inferred. That performance and data-availability assessment has not been retested.
EntraIdSignInEvents
| where AuthenticationRequirement == "multiFactorAuthentication"
| project Timestamp, AccountUpn, Application, IPAddress, AuthenticationRequirement,
ConditionalAccessPolicies, AuthenticationProcessingDetails,
RiskLevelAggregated, RiskState, RiskDetails, ConditionalAccessStatus
| extend ParsedCAP = parse_json(ConditionalAccessPolicies) // Parse if JSON; use mv-expand for arrays
| extend ParsedAuthDetails = parse_json(AuthenticationProcessingDetails) // Parse for auth flow details
Although Microsoft Entra ID P2 licenses can be bought separately, it is also included with the following products.
- Microsoft 365 E5
- Microsoft Defender Suite (formerly Microsoft 365 E5 Security)
- Microsoft Defender Suite FLW
- Microsoft Defender + Purview Suite FLW
- Enterprise Mobility + Security E5