User behavior profiles
User Behavior, under Security Operations, helps account managers review behavioral baselines built from account activity and DEVO or Microsoft Sentinel backfill data. The page is scoped to the selected account and is available to users with account-management permissions.
For Microsoft Sentinel, the mssentinel-user-behavior-profile-download agent queries the _Im_Authentication() ASIM parser through Microsoft Graph Advanced Hunting over a fixed seven-day (P7D) baseline window. It also checks optional audit, network, process, and web-session parsers for users in the authentication cohort. An unavailable optional parser is recorded as partial coverage. The agent refreshes a user only when at least five qualifying authentication events are available. The profile data is account-scoped and includes authentication-derived activity, source, geography, action, and outcome indicators. Sentinel profile and heartbeat collection uses the /beta/security/runHuntingQuery endpoint and requires the Microsoft Graph ThreatHunting.Read.All Application permission with tenant-wide admin consent and Advanced Hunting access to the selected workspace.
For Devo, the devo-user-behavior-profile-download agent queries auth.all over a seven-calendar-day window in the account time zone, stages each day, and then enriches the authentication cohort from supported Devo source tables when available. It retries individual day operations and aggregates only completed day phases, so partial coverage is retained in the baseline metadata. A user needs at least five qualifying authentication events before the profile is refreshed.
Find a profile
Open User Behavior from the application navigation. Use the filters to search by source account, department, or role. You can sort by baseline update time, source account, department, role, authentication-failure rate, or unknown-classification rate in ascending or descending order.
The list shows the source account, role, department, a weekday/weekend active-hours overview, authentication-failure rate, unknown-classification rate, baseline source, and last update time. Select a source account to open its details. Results are paginated at 25 profiles per page.
Read a profile
Profile details include:
- Role and Department when those values were resolved from the source data;
- Auth failure rate and Unknown classification rate as baseline indicators;
- Typical active hours, showing the hours included in the 90% activity baseline;
- Source geography, including the locations resolved from the baseline data;
- Datasource mix, showing the relative contribution of recorded data sources; and
- Action mix, showing behavior classifications and their coverage when available.
The detail page also shows the baseline source, update time, and number of sample periods. Empty sections mean that the relevant value was not resolved or recorded; they do not by themselves indicate a security incident.
Change the display time zone
Use Display timezone to convert active hours and profile dates to a time zone that is useful for your review. The choice is saved in your browser and applies to the profile list and detail pages. Changing the display time zone does not change the stored baseline.
Step-by-step: review a user behavior profile
- Confirm the selected account in the header.
- Open User Behavior.
- Choose a display time zone. Use the search, department, or role filters when the list is large, then select Apply.
- Review the active-hours overview and the authentication-failure and unknown-classification rates.
- Select a source account to inspect its role, department, baseline metadata, geography, datasource mix, and action mix.
- Change the display time zone when comparing activity with local working hours, then return to the profile list with All profiles.
Profiles appear after the configured DEVO or Microsoft Sentinel behavior-profile agent has collected enough activity. If the page is empty, confirm the selected account and review the behavior-profile download agent history with an administrator.