ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 23:56 UTC Customize Public modeDiscuss ChangeIntel on Discord

Identity Protection risk detections

This page's changes and edits · All guidance changes

Microsoft's edit ·

idp-licenses-091125

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 56d86ef · +28 −10 lines · also on GitHub

⋯ 4 unchanged lines
55 ms.service: entra-id-protection
66
77 ms.topic: article
8 −ms.date: 08/06/2025
8 +ms.date: 09/11/2025
99
1010 author: shlipsey3
1111 ms.author: sarahlipsey
⋯ 66 unchanged lines
7878 This detection is discovered using information provided by [Microsoft Defender for Cloud Apps](/defender-cloud-apps/anomaly-detection-policy#activity-from-anonymous-ip-addresses). This detection identifies that users were active from an IP address identified as an anonymous proxy IP address.
7979
8080 - Calculated offline
81 −- License requirement: Microsoft Entra ID P2 *and* Microsoft 365 E5, Enterprise Mobility + Security E5, or standalone license for Microsoft Defender for Cloud Apps.
81 +- License requirement:
82 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
83 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
8284
8385 ### Additional risk detected (sign-in)
8486
⋯ 42 unchanged lines
127129 This detection is discovered using information provided by [Microsoft Defender for Cloud Apps](/defender-cloud-apps/anomaly-detection-policy#impossible-travel). This detection identifies user activities (in a single or multiple sessions) originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second. This risk might indicate that a different user is using the same credentials.
128130
129131 - Calculated offline
130 −- License requirement: Microsoft Entra ID P2 *and* Microsoft 365 E5, Enterprise Mobility + Security E5, or standalone license for Microsoft Defender for Cloud Apps.
132 +- License requirement:
133 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
134 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
131135
132136 ### Malicious IP address
133137
⋯ 8 unchanged lines
142146 This detection is discovered using information provided by [Microsoft Defender for Cloud Apps](/defender-cloud-apps/investigate-anomaly-alerts#unusual-file-access-by-user). This detection looks at your environment and triggers alerts when users access multiple files from Microsoft SharePoint Online or Microsoft OneDrive. An alert is triggered only if the number of accessed files is uncommon for the user and the files might contain sensitive information.
143147
144148 - Calculated offline
145 −- License requirement: Microsoft Entra ID P2 *and* Microsoft 365 E5, Enterprise Mobility + Security E5, or standalone license for Microsoft Defender for Cloud Apps.
149 +- License requirement:
150 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
151 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
146152
147153 ### Microsoft Entra threat intelligence (sign-in)
148154
⋯ 8 unchanged lines
157163 This detection is discovered using information provided by [Microsoft Defender for Cloud Apps](/defender-cloud-apps/anomaly-detection-policy#activity-from-infrequent-country). This detection considers past activity locations to determine new and infrequent locations. The anomaly detection engine stores information about previous locations used by users in the organization.
158164
159165 - Calculated offline
160 −- License requirement: Microsoft Entra ID P2 *and* Microsoft 365 E5, Enterprise Mobility + Security E5, or standalone license for Microsoft Defender for Cloud Apps.
166 +- License requirement:
167 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
168 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
161169
162170 ### Password spray
163171
164172 A password spray attack is where multiple identities are attacked using common passwords in a unified brute force manner. The risk detection is triggered when an account's password is valid and has an attempted sign in. This detection signals that the user's password was correctly identified through a password spray attack, not that the attacker was able to access any resources.
165173
166174 - Calculated in real-time or offline
167 −- License requirement: Microsoft Entra ID P2
175 +- License requirement:
176 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
177 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
168178 - [Tips for investigating password spray detections.](howto-identity-protection-investigate-risk.md#investigating-password-spray-detections)
169179
170180 ### Suspicious browser
⋯ 9 unchanged lines
180190 This detection is discovered using information provided by [Microsoft Defender for Cloud Apps](/defender-cloud-apps/anomaly-detection-policy#suspicious-inbox-forwarding). This detection looks for suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
181191
182192 - Calculated offline
183 −- License requirement: Microsoft Entra ID P2 *and* Microsoft 365 E5, Enterprise Mobility + Security E5, or standalone license for Microsoft Defender for Cloud Apps.
193 +- License requirement:
194 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
195 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
184196
185197 ### Suspicious inbox manipulation rules
186198
187199 This detection is discovered using information provided by [Microsoft Defender for Cloud Apps](/defender-cloud-apps/anomaly-detection-policy#suspicious-inbox-manipulation-rules). This detection looks at your environment and triggers alerts when suspicious rules that delete or move messages or folders are set on a user's inbox. This detection might indicate: a user's account is compromised, messages are being intentionally hidden, and the mailbox is being used to distribute spam or malware in your organization.
188200
189201 - Calculated offline
190 −- License requirement: Microsoft Entra ID P2 *and* Microsoft 365 E5, Enterprise Mobility + Security E5, or standalone license for Microsoft Defender for Cloud Apps.
202 +- License requirement:
203 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
204 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
191205
192206 ### Token issuer anomaly
193207
⋯ 77 unchanged lines
271285 This risk detection type is discovered using information provided by Microsoft Defender for Endpoint (MDE). A Primary Refresh Token (PRT) is a key artifact of Microsoft Entra authentication on Windows 10, Windows Server 2016, and later versions, iOS, and Android devices. A PRT is a JSON Web Token (JWT) issued to Microsoft first-party token brokers to enable single sign-on (SSO) across the applications used on those devices. Attackers can attempt to access this resource to move laterally into an organization or perform credential theft. This detection moves users to high risk and only fires in organizations that deploy MDE. This detection is high risk and we recommend prompt remediation of these users. It appears infrequently in most organizations due to its low volume.
272286
273287 - Calculated offline
274 −- License requirement: Microsoft Entra ID P2
288 +- License requirement:
289 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
290 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
275291
276292 ### Suspicious API traffic
277293
⋯ 7 unchanged lines
285301 This risk detection type is discovered using information provided by [Microsoft Defender for Office 365 (MDO)](/defender-office-365/air-about). This alert is generated when someone in your organization sent suspicious email and is either at risk of being or is restricted from sending email. This detection moves users to medium risk and only fires in organizations that deploy MDO. This detection is low-volume and is seen infrequently in most organizations.
286302
287303 - Calculated offline
288 −- License requirement: Microsoft Entra ID P2
304 +- License requirement:
305 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
306 + - Microsoft 365 E5 with Enterprise Mobility + Security E5
289307
290308 ### User reported suspicious activity
291309
⋯ 4 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 23:56 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.