Identity Protection risk detections
Any two versions this installation kept of the page, compared the same way as each observed change. All guidance changes · Latest observation
What changed across 2 changes
1 new passage (12 words), 1 edited passage (1 word changed), 9 removed passages (about 100 words). The changed wording mentions prerequisites. Review the source to confirm the effect.
May need admin actionCheck whether new requirements apply to your setup.
… Suspicious MFA authentication approval Real-time Premium authenticatorPhishing Additional risk detected (sign-in) Real-time or Offline Nonpremium generic ^ Admin confirmed user compromised Offline Nonpremium adminConfirmedUserCompromised Anomalous Token (sign-in) Real-time or Offline Premium anomalousToken Anonymous IP address Real-time Nonpremium anonymizedIPAddress Atypical travel[removed: Offline][added: Real-time] Premium unlikelyTravel Impossible travel Offline Premium mcasImpossibleTravel Malicious IP address Offline Premium maliciousIPAddress Mass Access to Sensitive Files Offline Premium mcasFinSuspiciousFileAccess Microsoft Entra threat intelligence (sign-in) Real-time or Offline Nonpremium investigationsThreatIntelligence New country Offline Premium newCountry Password spray Real-time or …
[added: The system uses adaptive learning to learn a new user's sign-in behavior.]
[removed: Note]
[removed: Access to this page requires authorization. You can try signing in or changing directories.]
[removed: Access to this page requires authorization. You can try changing directories.]
[removed: The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.]
[removed: Was this page helpful?]
[removed: Need help with this topic?]
[removed: Want to try using Ask Learn to clarify or guide you through this topic?]
Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.
Sections to inspect
- Sign-in risk detections mapped to riskEventType
- Atypical travel
- What are risk detections?
- Feedback
- Additional resources
Read the current Microsoft source
Compared across every change between the two versions, so an edit made and later undone does not show. Observation time is not publication time. Full source bodies are not published; as the page's license allows, only Microsoft's changed wording is shown.