The housing authority has an on-prem domain controller plus Entra ID for cloud apps. A privileged-logon hunt used only Entra content. What did the hunt miss?
Select an answer to reveal the explanation.
Short Explanation
Hybrid identity is two cameras, not one. Entra sees the cloud apps; the domain controller still sees the on-prem admin logon. Hunt both sourcetypes or the local path stays invisible.
Full Explanation
Hybrid civic directories require assessing both the on-premises Windows or Active Directory sourcetype and the cloud identity sourcetype. Cloud-only Entra content will not show an interactive or network logon against the on-prem domain controller. VPC Flow Logs and the deployment-server _audit index are not substitutes for Authentication CIM events from either identity source. Both sourcetypes belong in the coverage picture.