docs: guide customer Entra sign-in monitoring and alerts

README.md

@@ -246,6 +246,7 @@ Deleting Azure resources does not undo an authentication policy change.
 | Find IDs, add provider credentials, or run acceptance checks | [Customer configuration and validation](docs/ONBOARDING.md) |
 | Resolve a setup or delivery problem | [Troubleshooting](setup/docs/Troubleshooting.md) |
 | Find logs and set up alerts | [Monitoring](docs/MONITORING.md) and [Application Insights](docs/APPLICATION-INSIGHTS.md) |
+| Monitor authentication outcomes and potential abuse | [Microsoft Entra sign-in monitoring](docs/SIGN-IN-MONITORING.md); configured separately from endpoint telemetry |
 | Understand the architecture, settings, or packages | [Technical reference](TECHNICAL.md) and [HTTP contract](docs/CONTRACT.md) |
 | Explore multiple Azure regions | [Manual Front Door guide](docs/FRONTDOOR.md); not included in guided setup |
 | Build a custom implementation | [JavaScript](javascript/README.md), [C#](dotnet/README.md), or [Python](python/README.md) |

docs/APPLICATION-INSIGHTS.md

@@ -6,6 +6,10 @@ reported along the way. It does **not** confirm that an SMS or voice call reache
 **Looking for your logs?** Start with the [monitoring guide](MONITORING.md). It shows how to find
 the resources from your deployment summary, run queries, and create alerts.
 
+For user authentication outcomes, see [Microsoft Entra sign-in monitoring](SIGN-IN-MONITORING.md).
+It uses a separate tenant log-export pipeline, not Function telemetry; neither source alone
+proves phone delivery.
+
 This reference explains how collection works for **JavaScript, .NET isolated, and Python**,
 what each signal means, and why data may be missing. Start with
 [single-region configuration](#single-region-configuration) to check a guided deployment;

docs/MONITORING.md

@@ -3,6 +3,11 @@
 Use this guide to find your endpoint's logs and set up alerts. Guided setup creates Application
 Insights and a Log Analytics workspace, but **you still need to configure and test notifications**.
 
+For **tenant authentication outcomes and potential abuse signals**, use the separate
+[Microsoft Entra sign-in monitoring guide](SIGN-IN-MONITORING.md). Entra log export and
+sign-in alerts are not configured by endpoint setup; sign-in failures are not automatically
+provider failures or evidence of OTP delivery.
+
 For your first single-region deployment:
 
 1. [Find the monitoring resources and confirm data is arriving](#1-record-the-deployment-and-confirm-telemetry)

docs/ONBOARDING.md

@@ -12,6 +12,10 @@ the [values worksheet](#values-and-ownership), or the [setup reference](../setup
 [Local development and manual deployment](#optional-local-development-and-manual-deployment)
 are separate, optional paths.
 
+For operational handover, use [Function monitoring](MONITORING.md) and, separately,
+[Microsoft Entra sign-in monitoring](SIGN-IN-MONITORING.md) for authentication outcomes
+and potential abuse investigations. Endpoint setup does not enable tenant log export or alerts.
+
 ## Before purchasing or deploying
 
 Open [Microsoft Security Store](https://securitystore.microsoft.com/private-solutions) and review