Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 645a693 · +2 −2 lines · also on GitHub
⋯ 25 unchanged lines
2626
| Sign-in risk detection | Detection type | Type | riskEventType |
2727
| --- | --- | --- | --- |
2828
| [Activity from anonymous IP address](#activity-from-anonymous-ip-address) | Offline | Premium | riskyIPAddress |
29
−| [Authenticator-assisted phishing detection ](#authenticator-assisted-phishing-detection) | Real-time | Premium | authenticatorPhishing |
29
+| [Suspicious MFA authentication approval ](#suspicious-mfa-authentication-approval) | Real-time | Premium | authenticatorPhishing |
3030
| [Additional risk detected (sign-in)](#additional-risk-detected-sign-in) | Real-time or Offline | Nonpremium | generic ^ |
3131
| [Admin confirmed user compromised](#admin-confirmed-user-compromised) | Offline | Nonpremium | adminConfirmedUserCompromised |
3232
| [Anomalous Token (sign-in)](#anomalous-token-sign-in) | Real-time or Offline | Premium | anomalousToken |
⋯ 44 unchanged lines
7777
- Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
7878
- Microsoft 365 E5 with Enterprise Mobility + Security E5
7979
80
−### Authenticator-assisted phishing detection
80
+### Suspicious MFA authentication approval
8181
8282
This detection identifies sign-ins where unfamiliar properties such as ASN, browser, device, and GPS location data indicate a potential social engineering or phishing attack. The detection fires during sessions that use a *Password + MFA* authentication method *plus* telemetry from the Microsoft Authenticator app. The combination of these signals helps to increase the precision of the detection and flags the sign-in attempt as **High risk**. Location proximity between the authentication *requesting* device and the authentication *approving* device is analyzed by Microsoft Entra ID to help distinguish legitimate sign-ins from attacker-initiated sessions.
8383
⋯ 232 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.