Identity Protection risk detections
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
What changed across 2 changes
2 new passages (about 40 words), 1 edited passage (6 words changed). The changed wording mentions settings and controls. Review the source to confirm the effect.
May need admin actionCheck the settings the wording names.
… Attacker in the Middle Offline Premium attackerinTheMiddle Leaked credentials Offline Nonpremium leakedCredentials Microsoft Entra threat intelligence (user) Real-time or Offline Nonpremium investigationsThreatIntelligence Possible attempt to access Primary Refresh Token (PRT) Offline Premium attemptedPrtAccess Suspicious API Traffic Offline Premium suspiciousAPITraffic Suspicious [added: credential addition Real-time Premium suspiciousCredentialAddition Suspicious] sending patterns Offline Premium suspiciousSendingPatterns User reported suspicious activity Offline Premium userReportedSuspiciousActivity
[added: This detection identifies when a new authentication method is added to an account under suspicious circumstances. This activity might indicate that an attacker has accessed the account and registered a new credential.]
Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.
Sections to inspect
Read the current Microsoft source
Compared across every change between the two versions, so an edit made and later undone does not show. Observation time is not publication time. Full source bodies are not published; as the page's license allows, only Microsoft's changed wording is shown.