Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 3e9b8f0 · +3 −6 lines · also on GitHub
⋯ 25 unchanged lines
2626
| Sign-in risk detection | Detection type | Type | riskEventType |
2727
| --- | --- | --- | --- |
2828
| [Activity from anonymous IP address](#activity-from-anonymous-ip-address) | Offline | Premium | riskyIPAddress |
29
−| [Authenticator-assisted phishing detection (preview)](#authenticator-assisted-phishing-detection-preview) | Real-time | Premium | authenticatorPhishing |
29
+| [Authenticator-assisted phishing detection ](#authenticator-assisted-phishing-detection) | Real-time | Premium | authenticatorPhishing |
3030
| [Additional risk detected (sign-in)](#additional-risk-detected-sign-in) | Real-time or Offline | Nonpremium | generic ^ |
3131
| [Admin confirmed user compromised](#admin-confirmed-user-compromised) | Offline | Nonpremium | adminConfirmedUserCompromised |
3232
| [Anomalous Token (sign-in)](#anomalous-token-sign-in) | Real-time or Offline | Premium | anomalousToken |
⋯ 44 unchanged lines
7777
- Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
7878
- Microsoft 365 E5 with Enterprise Mobility + Security E5
7979
80
−### Authenticator-assisted phishing detection (preview)
81
−
82
−> [!NOTE]
83
−> This feature is currently in preview. For more information about previews, see [Universal License Terms For Online Services](https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all).
80
+### Authenticator-assisted phishing detection
8481
85
−This detection identifies sign-ins where unfamiliar properties such as ASN, browser, device, and GPS location data indicate a potential social engineering or phishing attack. The detection fires during sessions that use Password plus multifactor authentication (MFA) and uses telemetry from the Microsoft Authenticator app to increase signal precision. Location proximity between the authentication requesting device and the authentication approving device is analyzed to help distinguish legitimate sign-ins from attacker-initiated sessions.
82
+This detection identifies sign-ins where unfamiliar properties such as ASN, browser, device, and GPS location data indicate a potential social engineering or phishing attack. The detection fires during sessions that use a password *and* multifactor authentication (MFA) *plus* telemetry from the Microsoft Authenticator app. The combination of these signals helps to increase the precision of the detection. Location proximity between the authentication *requesting* device and the authentication *approving* device is analyzed by Microsoft Entra ID to help distinguish legitimate sign-ins from attacker-initiated sessions.
8683
8784
- Calculated in real-time
8885
- License requirement: Microsoft Entra ID P2
⋯ 230 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.