Behavior-driven user profiling: A case study on microsoft entra ID sign-in

Behavioral profiling is widely used to characterize patterns in user activity, typically through clustering techniques that group similar behaviors. However, existing research often overlooks the role of feature engineering and assumes the availability of extensive historical data, assumptions that rarely hold in real-world settings. This study presents a case study on behavioral profiling using Microsoft Entra ID sign-in logs from a real-world cloud environment, and provides a systematic analysis of key design choices in profiling. In particular, we investigate how domain knowledge in feature engineering and the choice of data scope affect the quality and interpretability of behavioral profiles. Profiles are evaluated using both quantitative metrics and expert validation. Our results demonstrate that domain-informed features improve clustering quality and profiling accuracy. Moreover, profiles constructed from all available data remain distinctive across user groups, even under limited data availability, highlighting the robustness of the approach in realistic scenarios. Expert evaluation further shows that interpretability depends on the consistency and abstraction level of features. Moreover, the resulting profiles expose behavioral patterns that extend beyond experts’ typical user-centered analyses, providing a more comprehensive view of authentication behavior. Overall, our findings demonstrate that data-driven profiling, supported by expert validation, enables the construction of interpretable behavioral representations in cloud authentication environments.