4.2.2. Sentinel Graph Entity Relationships
💡 First Principle: Relationships between identities, devices, data, and cloud resources are spread across many data sources: directory memberships in Entra ID, permissions in Azure, logons in endpoint telemetry, file access in Purview. The Sentinel graph models these as one connected structure built on the Sentinel data lake, so relationship questions span the whole environment instead of one product's view.
The Microsoft Sentinel graph represents entities (users, groups, devices, applications, cloud resources, data stores) and their relationships (membership, permissions, access, activity) as a graph that experiences across the Defender portal draw on. Where an incident graph is scoped to one incident's evidence, the Sentinel graph is environment-wide. Analysts meet it in several forms: blast radius views when investigating an incident or entity, the hunting graph scenarios above, and graph-powered context in data security investigations. Microsoft also positions the graph as context for AI agents, and custom graphs (preview) can be built from data lake data in notebooks and queried with GQL. Treat any direct MCP access to the graph as unconfirmed; the documented MCP tools (4.3.3) query lake tables.
Analyzing relationships with the Sentinel graph answers questions such as:
- Which groups, roles, and resources does this compromised identity have access to, directly and through nesting?
- Which other users have logged on to the same devices, and could have exposed credentials?
- Is this first-time access by an identity to a resource unusual given the graph of normal relationships?
- Which data stores could be read if this service principal's credential is stolen?
The analyst's skill is turning a graph answer into an action: an unexpected path becomes a permission to remove; a reachable sensitive store becomes an asset to monitor or isolate; a first-time access relationship becomes a hunting lead, often validated with KQL against the underlying tables (IdentityLogonEvents, AzureActivity, CloudAppEvents).
The Sentinel graph and its experiences are recent additions, and some capabilities are in preview, so expect the exam to test concepts (environment-wide relationships, blast radius, prerequisites such as data lake onboarding) rather than portal clicks.
⚠️ Exam Trap: When a question contrasts "the investigation graph for this incident" with "relationships across the entire environment," the environment-wide answer is the Sentinel graph (and the hunting graph built on it), not the incident graph and not a Sentinel workbook.
Reflection Question: Why does modeling relationships as a graph make "who can reach this key vault through any chain of permissions?" easier to answer than writing joins across several log tables?
