Identity Protection risk detections

This page's changes and edits · All guidance changes

Microsoft's edit · 6 Mar 18:13 UTC

updates

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 4911b5e · +3 −3 lines · also on GitHub

⋯ 145 unchanged lines

146146

147147 ### Microsoft Entra threat intelligence (sign-in)

148148

149 −Microsoft Entra threat intelligence indicates user activity that is unusual for the user or consistent with known attack patterns. This detection is based on Microsoft's internal and external threat intelligence sources. These detections show up as "Microsoft Entra threat intelligence" in logs and ID Protection reports.

149 +Microsoft Entra threat intelligence indicates user activity that is unusual for the user or consistent with known attack patterns. This detection is based on Microsoft's internal and external threat intelligence research, including data from the Microsoft Threat Intelligence Center (MSTIC) and other Microsoft security teams. These detections show up as "Microsoft Entra threat intelligence" in logs and ID Protection reports.

150150

151151 - Calculated in real-time or offline

152152 - License requirement: Microsoft Entra ID Free or Microsoft Entra ID P1

⋯ 10 unchanged lines

163163

164164 ### Password spray

165165

166 −A password spray attack is where multiple identities are attacked using common passwords in a unified brute force manner. The risk detection is triggered when an account's password is valid and has an attempted sign in. This detection signals that the user's password was correctly identified through a password spray attack, not that the attacker was able to access any resources.

166 +A password spray attack is where multiple identities are attacked using common passwords in a unified brute force manner. Microsoft monitors password spray patterns across IP addresses and other identifiers to detect these attacks across all Microsoft Entra tenants. The risk detection is only triggered when an attacker successfully validates a user's password. Unsuccessful spray attempts against your users don't generate a detection. When the detection fires in your tenant, it means Microsoft observed a spray attack and confirmed that the attacker achieved a successful credential validation against a user in your tenant. This detection signals that the user's password was correctly identified, not that the attacker was able to access any resources.

167167

168168 - Calculated in real-time or offline

169169 - License requirement: Microsoft Entra ID P2

⋯ 98 unchanged lines

268268

269269 ### Microsoft Entra threat intelligence (user)

270270

271 −This risk detection type indicates user activity that is unusual for the user or consistent with known attack patterns. This detection is based on Microsoft's internal and external threat intelligence sources.

271 +This risk detection type indicates user activity that is unusual for the user or consistent with known attack patterns. This detection is based on Microsoft's internal and external threat intelligence research, including data from the Microsoft Threat Intelligence Center (MSTIC) and other Microsoft security teams.

272272

273273 - Calculated offline

274274 - License requirement: Microsoft Entra ID Free or Microsoft Entra ID P1

⋯ 33 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.