It is included at no extra cost, and most Sentinel customers have never switched it on.
UEBA builds behavioural profiles for users, hosts, IP addresses and applications, then flags deviations against them. Microsoft states it is included with Sentinel at no extra cost, with data stored in Log Analytics tables under standard pricing.
- No extra costUEBA is included with Sentinel
- 6 tablesWhere UEBA insights are stored
- Two scoresThat deliberately disagree with each other
- Top 20 peersRanked per user for peer comparison
Eight things that determine whether you get value from it.
Behavioural profiles for more than users
Machine learning builds dynamic behavioural profiles for users, hosts, IP addresses, applications and other entities, then detects anomalies by comparing current activity to established baselines. The named use cases are compromised accounts, insider attacks and lateral movement.
Peer comparison, weighted intelligently
UserPeerAnalytics ranks the top 20 peers for a user based on security group membership, mailing lists and other associations, using a term frequency and inverse document frequency approach where smaller groups carry higher weight. Membership of a small specialised group says more than membership of one everybody is in.
Two scores measuring different things
Investigation priority runs 0 to 10 in the BehaviorAnalytics table and measures how unusual a single event is, near real time. Anomaly score runs 0 to 1 in the Anomalies table and measures holistic anomalous behaviour across multiple events, in batch. They are not interchangeable.
Blast radius as part of the assessment
Alongside behavioural modelling, UEBA applies peer group analysis and blast radius evaluation to assess the impact of anomalous activity. That is what separates an unusual action by somebody with minimal access from the same action by somebody who can reach everything.
Identity context from both directories
IdentityInfo holds detailed profiles of users, devices and groups, built from Microsoft Entra ID and optionally from on-premises Active Directory through Microsoft Defender for Identity. For hybrid estates that second source is what makes the profiles complete rather than cloud-only.
The behaviours layer is a separate switch
Microsoft is explicit that the UEBA behaviours layer is a separate capability enabled independently from UEBA, and that the SentinelBehaviorInfo and SentinelBehaviorEntities tables are only created if you enable it. Querying for tables that do not exist yet is a common early confusion.
Queries you do not have to write
The UEBA Essentials solution provides dozens of pre-built hunting queries curated and maintained by Microsoft security experts, including multi-cloud anomaly detection queries across Azure, AWS, Google Cloud Platform and Okta. Installing it is how a team gets value in days rather than months.
Embedded experiences in the Defender portal
A home page widget, UEBA context on user pages with automatic tagging when unusual behaviour is detected, a top UEBA anomalies section showing the top three from the past 30 days, built-in anomaly queries launchable from incident graphs, and a hunting banner prompting a join to the Anomalies table.
The two scores can disagree, and that is the design working correctly.
Microsoft gives a worked example, and understanding it prevents a team concluding one of the scores is broken.
- When a user performs an Azure operation for the first time, the investigation priority score is high because it is a first-time event, while the anomaly score is low because occasional first-time Azure actions are common and not inherently risky. Both numbers are correct and they answer different questions.
- Investigation priority lives in BehaviorAnalytics, runs 0 to 10, is calculated near real time at event level, and combines an entity anomaly score covering the rarity of the user, device and country or region with a time series score covering abnormal patterns over time such as spikes in failed sign-ins.
- Anomaly score lives in the Anomalies table, runs 0 to 1, is batch processed at behaviour level, and comes from an AI and machine learning anomaly detector trained on your own workspace telemetry. It exists to identify patterns and aggregated anomalies over time rather than to triage one event.
- Microsoft notes you can expect some correlation, with high anomaly scores often aligning with high investigation priority, but not always. Each score provides unique insight for layered detection, which is why using only one of them wastes half the capability.
Four things that turn UEBA from enabled into used.
We install the queries rather than writing them
The UEBA Essentials solution provides dozens of pre-built hunting queries curated and maintained by Microsoft security experts, with multicloud coverage across Azure, AWS, Google Cloud Platform and Okta. Building equivalent detection capability from scratch takes months and produces something worse.
We teach the two scores as two different tools
Investigation priority is a 0 to 10 near real time measure of how unusual one event is, for triage. Anomaly score is a 0 to 1 batch measure of behaviour across multiple events, for pattern analysis. Teams that treat them as the same number conclude one of them is wrong.
We check which tables you actually have
Coverage depends on which connectors are enabled, and the behaviours layer tables only exist if that separate capability was enabled. Half an hour confirming which tables are populated saves an analyst a frustrating afternoon querying something that was never going to return rows.
We connect the on-premises identity source
IdentityInfo is built from Entra ID and optionally from on-premises Active Directory through Defender for Identity. In hybrid estates, skipping that second source produces profiles missing exactly the context that matters for lateral movement, which is one of the three named use cases.
Four phases across roughly five weeks.
- 01Week 1
Enable and connect the sources it depends on
UEBA enabled, and the key data sources connected: Microsoft Entra ID, Defender for Identity and Office 365 among them. Coverage in the BehaviorAnalytics table depends on which connectors are enabled, so this step determines how much of the estate is profiled at all.
- UEBA enabled in the workspace
- Entra ID, Defender for Identity and Office 365 connected
- Multicloud sources connected where they exist
- Behaviours layer decision recorded
- 02Week 2
Install UEBA Essentials and let baselines form
The UEBA Essentials solution installed, bringing dozens of pre-built hunting queries maintained by Microsoft security experts, including multicloud anomaly detection across Azure, AWS, Google Cloud Platform and Okta. Baselines need time and the queries need data underneath them.
- UEBA Essentials solution installed
- Pre-built hunting queries available to analysts
- IdentityInfo populated from both directories where hybrid
- Table availability confirmed per connected source
- 03Weeks 3 to 4
Build UEBA into the triage workflow
The phase that decides whether this is used. Investigation priority applied during triage of individual events, anomaly score used for pattern analysis over time, and hunting queries joined to the Anomalies table so investigations carry behavioural context by default.
- Investigation priority incorporated into triage
- Anomaly score used in periodic pattern review
- Existing hunting queries enriched with Anomalies joins
- Analyst guidance on when each score applies
- 04Week 5
Use the embedded experiences and hand over
Defender portal experiences adopted deliberately: the home page widget, user page UEBA context and the top three anomalies from the past 30 days, and the built-in anomaly queries from incident graphs. Then a review rhythm so the capability keeps being used.
- Defender portal UEBA experiences demonstrated to analysts
- Incident graph anomaly queries adopted
- Periodic anomaly pattern review scheduled
- Handover with query examples for the team
Six situations where behavioural context changes the answer.
A business investigating a possibly compromised account
Compromised accounts are one of the three named use cases. The question is whether this activity is normal for this person, and behavioural profiles plus peer comparison answer it directly, where a rule threshold can only say whether it crossed a number somebody picked.
An organisation with an insider concern
Insider attacks are the second named use case, and they are the hardest to detect with rules because the activity is authorised. Deviation from an individual baseline, and from what their peer group does, is the signal that a permission check cannot produce.
A company tracking lateral movement
The third named use case, and the one that most depends on complete identity context. Where the estate is hybrid, IdentityInfo built from Entra ID plus on-premises Active Directory through Defender for Identity is what makes the movement visible across the boundary.
A regulated firm prioritising a large alert queue
Investigation priority ranges 0 to 10 and combines entity rarity with time series patterns such as spikes in failed sign-ins. Used during triage it gives a defensible order of work, which is more useful than severity alone when everything is labelled high.
An operator with a multicloud footprint
The UEBA Essentials solution includes multicloud anomaly detection queries across Azure, AWS, Google Cloud Platform and Okta. For estates that ended up multicloud through acquisition, that is behavioural coverage across all of it without writing separate detection for each.
A team that wants more from Sentinel without more spend
UEBA is included with Sentinel at no extra cost, with data stored in Log Analytics tables under standard pricing. For an organisation already paying for Sentinel and looking for more value from it, enabling and using UEBA is among the highest return actions available.
How UAE organisations use behavioural analytics.
| Feature | Enabled and built into triage | Enabled, unused | Never enabled |
|---|---|---|---|
Behavioural baselines exist | Yes | Yes | No |
Investigation priority used in triage | Yes | No | Not applicable |
Anomaly patterns reviewed | Periodically | No | Not applicable |
Peer comparison available | Yes | Yes, unused | No |
Hunting queries enriched | Anomalies joined | No | Not applicable |
Pre-built queries installed | UEBA Essentials | No | No |
Hybrid identity context | Via Defender for Identity | Cloud only | None |
Insider risk signal | Present | Present, unread | Absent |
Lateral movement signal | Present | Present, unread | Absent |
Additional cost | None | None | None |
Six tables and what each is for.
| Table | What it holds | |
|---|---|---|
| IdentityInfo | Detailed profiles of users, devices and groups from Entra ID and optionally on-premises AD | |
| BehaviorAnalytics | Deviations from baseline with prioritisation scores, enriched with geolocation and threat intelligence | |
| UserPeerAnalytics | Dynamically calculated peer groups, top 20 peers ranked per user | |
| Anomalies | Events identified as anomalous, supporting detection and investigation | |
| SentinelBehaviorInfo | Who did what to whom summaries with natural language and MITRE ATT&CK mappings | |
| SentinelBehaviorEntities | Profiles of files, processes, devices and users involved in detected behaviours | |
| Behaviours layer tables | Only created if you enable the behaviours layer separately | |
| InvestigationPriority field | In BehaviorAnalytics, 0 to 10, near real time, single event | |
| AnomalyScore field | In Anomalies, 0 to 1, batch, behaviour across multiple events | |
| Coverage of these tables | Depends on which connectors are enabled |
Five steps, and the last two are about habits.
- 1
Enable UEBA and connect the key sources
Microsoft Entra ID, Defender for Identity and Office 365 are named as key sources, and coverage in the behavioural tables depends on which connectors are enabled. For hybrid estates, Defender for Identity is what brings on-premises Active Directory context into the identity profiles.
- 2
Decide on the behaviours layer explicitly
It is a separate capability enabled independently, and the SentinelBehaviorInfo and SentinelBehaviorEntities tables only exist if you enable it. Those tables translate raw logs into who did what to whom summaries with natural language explanations and MITRE ATT&CK mappings.
- 3
Install UEBA Essentials
Dozens of pre-built hunting queries curated and maintained by Microsoft security experts, including multicloud anomaly detection across Azure, AWS, Google Cloud Platform and Okta. This is the difference between having UEBA data and being able to use it in the first week.
- 4
Put investigation priority into the triage routine
A 0 to 10 near real time score of how unusual a single event is, combining entity rarity with time series patterns. Used during triage it gives an order of work grounded in behaviour rather than in a severity label everything shares.
- 5
Add a periodic anomaly pattern review
Anomaly score is batch processed at behaviour level across multiple events, so it answers a different question on a different rhythm. A scheduled review of anomaly patterns, and hunting queries joined to the Anomalies table, is how that half of the capability gets used at all.
What organisations ask about Sentinel UEBA.
Fifteen questions about your own UEBA position.
Enablement
- Is UEBA enabled at all?It is included at no extra cost.
- Is Entra ID connected?A key source for profiles.
- Is Defender for Identity connected?It brings on-premises AD context.
- Is Office 365 connected?Named as a key source.
- Have we enabled the behaviours layer?Separate switch, separate tables.
Data
- Is IdentityInfo populated?From Entra ID and optionally AD.
- Does BehaviorAnalytics have data?It depends on connectors.
- Is UserPeerAnalytics building peer groups?Top 20 per user.
- Are multicloud sources connected?AWS, GCP and Okta are covered.
- Have we installed UEBA Essentials?Dozens of pre-built queries.
Use
- Do analysts use investigation priority?For single event triage.
- Does anybody review anomaly score patterns?For behaviour over time.
- Do hunting queries join the Anomalies table?The portal prompts for this.
- Do we use the incident graph anomaly queries?Built in, one click.
- Does anybody look at the UEBA widget?On the Defender home page.
Check whether UEBA is enabled in your Sentinel workspace.
It is included at no extra cost and a large share of customers have never switched it on. If it is off, you are paying to ingest the data it would have profiled and getting none of the behavioural context.
Related Services
Explore more solutions that work great with this service
Sentinel Analytics Rules
Detections analysts actually read
KQL Threat Hunting
Hunting across Defender data, and turning it into detections
Insider Risk Management
Data theft by departing staff, detected with users pseudonymised
Microsoft Sentinel
Cloud-native SIEM and threat intelligence
Sentinel Data Connectors
Getting data in, and knowing when it stops
Defender for Identity
Lateral movement and domain dominance, detected across AD and Entra
Entra ID Protection
On P1 you see a flag. On P2 you see why, and can act on it
SOC-as-a-Service
24/7 SOC on Microsoft Sentinel