docs: recommend three practical Entra log monitors

[Hou (SciencePotato)]

What changed

Lead the Entra monitoring guide with three practical recommendations:

1. Integration application and managed-identity authentication failures.
2. Unexpected changes to integration credentials, permissions, or trust settings.
3. Recurring customer sign-in problems, with background session/token issues kept separate.

Each recommendation explains which logs to use, how to scope them to the right identities and resources, when to notify someone, and what the owner should check first. The existing export, alert, and safe-testing walkthrough is reused rather than duplicated.

Optional field guidance explains the five diagnostic categories and their workspace tables, portal-export versus Log Analytics field differences, overall outcomes versus authentication-step success, and record IDs versus correlated sign-in sequences. Links point to official schemas and instructions; no inline queries or configuration samples are added.

The focus is Entra authentication and configuration, not Function delivery. Notification thresholds must reflect ordinary traffic and the team's response needs; consent/session interruptions, planned changes, or cached-token inactivity are not automatically outages or fraud.

Review and verification

Three passes checked monitoring applicability and ownership, official schema semantics and false positives, and readability/rendering/privacy. All 72 local link/anchor checks pass, existing anchors are preserved, seven new Microsoft references were verified, Markdown renders correctly, and git diff --check passes.

Only README.md and docs/SIGN-IN-MONITORING.md changed. No customer records, identifiers, names, IP addresses, export filenames, or dataset analysis are included. No runtime, infrastructure, or cloud changes were made; runtime tests are not applicable.

Based on main b95bf38. Reviewed head: c8751c1.