Identity Protection risk detections

This page's changes and edits · All guidance changes

Microsoft's edit · 11 Sep 2025 23:31 UTC

missed-detection

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 7bf37a9 · +4 −4 lines · also on GitHub

⋯ 171 unchanged lines

172172 A password spray attack is where multiple identities are attacked using common passwords in a unified brute force manner. The risk detection is triggered when an account's password is valid and has an attempted sign in. This detection signals that the user's password was correctly identified through a password spray attack, not that the attacker was able to access any resources.

173173

174174 - Calculated in real-time or offline

175 −- License requirement:

176 − - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps

177 − - Microsoft 365 E5 with Enterprise Mobility + Security E5

175 +- License requirement: Microsoft Entra ID P2

178176 - [Tips for investigating password spray detections.](howto-identity-protection-investigate-risk.md#investigating-password-spray-detections)

179177

180178 ### Suspicious browser

⋯ 81 unchanged lines

262260 Also referred to as Adversary in the Middle, this high precision detection is triggered when an authentication session is linked to a malicious reverse proxy. In this kind of attack, the adversary can intercept the user's credentials, including tokens issued to the user. The Microsoft Security Research team uses Microsoft 365 Defender for Office to capture the identified risk and raises the user to **High** risk. We recommend administrators manually investigate the user when this detection is triggered to ensure the risk is cleared. Clearing this risk might require secure password reset or revocation of existing sessions.

263261

264262 - Calculated offline

265 −- License requirement: Microsoft Entra ID P2

263 +- License requirement:

264 + - Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps

265 + - Microsoft 365 E5 with Enterprise Mobility + Security E5

266266

267267 ### Leaked credentials

268268

⋯ 45 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.