How a client's security settings work in CyberSentry
Teach CyberSentry how each client's people really work, so ordinary travel stops looking like an attack and real threats still stand out. One tab per client holds the risk posture, allowed countries and networks, travel exceptions and that client's own alerts.
CyberSentry - this client
The Security tab of a client record holds a card called CyberSentry - this client, which is closed until you open it. The badge on its header says how much of the sign-in feed this client's Microsoft licensing allows: Full coverage, or No P1.
What is being watched
Token-theft detection is active means session-fork and token-replay analysis is running on this client's sign-in logs. Without Microsoft Entra ID P1 the card says that detection is off instead, and names what still runs on the free directory audit feed.
Risk posture and context notes
Risk posture is Inherit MSP default, Standard, Strict or Paranoid. Context notes for this client is free text about how this client works, which Elise reads when it triages. For example, a note that this client has a remote team in Mexico tells Elise to treat Mexican sign-ins as expected.
Allowed countries and Allowed IP ranges
Countries as two-letter codes, one per line, and this client's known office or VPN ranges in CIDR, one per line. Neither is required. Left blank, CyberSentry relies on its other signals, and the Learned shared-egress networks table further down the card shows the networks it has learned on its own.
Workforce profile
How much this client's staff normally move around. The picker holds Office: works from known locations, Hybrid: some remote/travel is normal (default), and Field: travels constantly for work, and the line underneath explains the one you picked. It changes how loudly ordinary travel reads, not whether a real threat is detected, and it never opens or closes a ticket by itself.
Travel exceptions
An exception for one person you know is travelling, added under User (UPN). Countries is optional and scopes it, Until sets the end date, Note is for your own team, and Add puts it on the list. Left blank, Until makes the exception Permanent, and the card asks you to review those from time to time. An amber line warns you when Countries is left blank, because that dampens sign-ins from any country for that person.
Learned shared-egress networks
Read-only. The networks this client's own people keep signing in from, with Distinct people, Days seen, First seen, Last seen and a Status of Trusted or Learning. It fills in on its own as sign-ins come in.
Save
Nothing you change on this card takes effect until you press Save.
This client's alerts
Under the card sits this client's own alert list, the same list the main CyberSentry alerts page uses, limited to this client. Clicking a row opens that alert's own page.
Browse
On this page
Why it works this way: How a client's security settings work in CyberSentry
Each alert opens its own page with the facts, the Elise triage, the score behind it and a simulator for trying a change without saving one. That page is covered in What a security alert page shows.
A travel exception never dampens a hard indicator such as a banned country, a known attacker address, Tor or an anonymous proxy. Used together with other legitimate signals it can still quiet an alert for that person, so scope Countries to where they travel and prefer an end date.
The learned network table is the automatic version of the allowed IP list. A network only becomes Trusted once enough distinct people at the client have used it across enough distinct days, and it never overrides a genuinely suspicious sign-in.
This tab only appears on a client that has the Microsoft integration, because everything on it reads that client's own sign-in data.
The workforce profile, the allowed lists and the exceptions all change how loudly ordinary travel reads. None of them decides whether a ticket opens: that is decided by an armed response rule or by the confidence engine's own bands.
Questions this page answers
What does Workforce profile do?
Tells CyberSentry how much this client's staff normally move around, so it can judge new-network and new-device sign-ins accordingly. Office means staff work from known locations - an unfamiliar network or device is treated exactly as suspicious as it looks today, no change. Hybrid (the default) expects some remote work and travel is normal - when the sign-in data confirms MFA was satisfied, that can mildly soften an otherwise-corroborated alert, but it never eliminates one on its own; a genuinely dangerous sign-in still surfaces. Field means staff travel constantly for work - a sign-in from a new, in-country network or device with no other unfamiliar signal shows as a low-priority alert instead of going undetected. Pick the profile that matches how this client's team actually works - it changes how loudly ordinary travel reads, never whether a real threat is detected, and it never opens or blocks a ticket by itself (see "Why didn't this alert open a ticket?" on the alert page for where tickets actually come from).
What do Allowed countries and Allowed IP ranges do?
Tell CyberSentry where this client's legitimate sign-ins normally come from. Allowed countries lists the countries this client's staff sign in from as part of normal business - sign-ins from a listed country read as familiar; sign-ins from anywhere else still get evaluated, they just don't get the benefit of a known location. Allowed IP ranges lists this client's known office or VPN network ranges (CIDR notation) - a sign-in from one of these ranges is recognized immediately, without waiting for the platform to learn it the slow way. Neither field is required; leave them blank and CyberSentry falls back to what it learns automatically over time (the read-only egress ledger below shows what it has picked up on its own). Filling them in for a client with a lot of remote or travelling staff is one of the fastest ways to quiet first-week noise.
How do travel exceptions work?
A travel exception is a time-boxed dampener for one specific person (by UPN) who you know is travelling - it softens location/network/device signals for that person, it does not add them to a bypass list. Countries is optional: scope it to the countries this person is actually visiting, or leave it blank to dampen sign-ins from anywhere (a broad grant - the form warns you when you do this, so scope it whenever you can). Every exception needs an end date, or you can leave it Permanent - the badge for that just reads "Permanent", and the form reminds you to set an end date instead, since an open-ended exception is easy to forget about long after the trip is over. Important: a genuine hard indicator (banned country, known-attacker IP, Tor, anonymous proxy) is NEVER dampened by an exception, no matter how it's scoped. But combined with other legitimate signals available on that sign-in, an active exception CAN suppress an alert for that person entirely, not just soften it. That is deliberate: you are vouching for this person's travel, so use it only for someone you actually trust to be where they say they are, and remove it once they're back.
Was this helpful?