The test analytics rule must generate alerts for inbound Office 365 access by several test users and group those alerts into separate incidents-one per user . In Azure Sentinel, incident grouping by entity depends on the rule's Entity mapping . When you create a scheduled analytics rule, under Set rule logic you map columns from your query to entities like Account , IP , or Host . Once mapped, you can configure Event grouping so alerts with the same entity value (e.g., the same Account ) are automatically grouped into a single incident.
Turning suppression on/off or changing severity/tactics doesn't influence entity-based incident grouping.
Therefore, to ensure "one incident per test user account," you must map the Account entity (and any other relevant entities) in Set rule logic , then enable grouping by that entity-fulfilling the Sentinel requirement.