Identity Protection risk detections
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
What changed
1 new passage (12 words), 1 edited passage (1 word changed), 1 removed passage (about 50 words). No rule matched the changed words; review the source for its effect.
Read to decideThe wording changed without matching a rule; read the changed passages to decide.
… Suspicious MFA authentication approval Real-time Premium authenticatorPhishing Additional risk detected (sign-in) Real-time or Offline Nonpremium generic ^ Admin confirmed user compromised Offline Nonpremium adminConfirmedUserCompromised Anomalous Token (sign-in) Real-time or Offline Premium anomalousToken Anonymous IP address Real-time Nonpremium anonymizedIPAddress Atypical travel[removed: Offline][added: Real-time] Premium unlikelyTravel Impossible travel Offline Premium mcasImpossibleTravel Malicious IP address Offline Premium maliciousIPAddress Mass Access to Sensitive Files Offline Premium mcasFinSuspiciousFileAccess Microsoft Entra threat intelligence (sign-in) Real-time or Offline Nonpremium investigationsThreatIntelligence New country Offline Premium newCountry Password spray Real-time or …
[added: The system uses adaptive learning to learn a new user's sign-in behavior.]
[removed: The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.]
Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.
Sections to inspect
Read the current Microsoft source
Compared across every change between the two versions, so an edit made and later undone does not show. Observation time is not publication time. Full source bodies are not published; as the page's license allows, only Microsoft's changed wording is shown.