Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 47783df · +2 −3 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.service: entra-id-protection
66
77
ms.topic: article
8
−ms.date: 09/11/2025
8
+ms.date: 01/07/2026
99
1010
author: shlipsey3
1111
ms.author: sarahlipsey
⋯ 249 unchanged lines
261261
262262
- Calculated offline
263263
- License requirement:
264
− - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
265264
- Microsoft 365 E5 with Enterprise Mobility + Security E5
266265
267266
### Leaked credentials
⋯ 39 unchanged lines
307306
308307
### User reported suspicious activity
309308
310
−This risk detection is reported when a user denies a multifactor authentication (MFA) prompt and reports it as suspicious activity. An MFA prompt not initiated by a user might mean their credentials are compromised.
309
+This risk detection is reported when a user denies a multifactor authentication (MFA) prompt and reports it as suspicious activity. An MFA prompt not initiated by a user might mean their credentials are compromised. For this detection to work, you must have the **Report suspicious activity** feature turned on. For more information, see [Configure Microsoft Entra MFA settings](../identity/authentication/howto-mfa-mfasettings.md#report-suspicious-activity).
311310
312311
- Calculated offline
313312
- License requirement: Microsoft Entra ID P2
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.