Sentinel Watchlist

SigninLogs | where UserPrincipalName in (Watchlist_HighValue)

Cross logins with a Sentinel watchlist (high-value accounts) to alert on the use of critical accounts.

Use it when you want to prioritize monitoring of accounts that cannot fail: the watchlist (Sentinel's managed list, feedable manually or from TIP/SOAR) contains high-value accounts — domain admins, critical service accounts, backup accounts — and the query crosses SigninLogs against that list. Any use of those accounts (especially out of hours or from rare locations) triggers. It's the way to focus SOC attention on what matters: not all accounts deserve the same vigilance, and the watchlist materializes that priority. It's also used for critical IPs, hosts, or domains.

Don't use it without maintaining the watchlist: an outdated list (accounts that no longer exist, or new ones not added) gives false positives or gaps — maintenance is part of the operation. The join on UserPrincipalName requires the format to match exactly (case, domain): a silent mismatch returns zero. And beware: the query alone doesn't alert — the watchlist is used within an analytics rule or hunting; without the rule, it's just a manual query. The volume of SigninLogs from legitimate admin accounts can be high: combine the watchlist with anomaly filters (location, device) to avoid overwhelming the team.