Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 82e232b · +5 −7 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Explore the full list of risk detections and their corresponding risk event types, along with a description of each risk event type.
44
ms.service: entra-id-protection
55
ms.topic: reference
6
−ms.date: 10/19/2026
6
+ms.date: 10/21/2026
77
ms.reviewer: lvandenende
88
ai-usage: ai-assisted
99
ms.custom: msecd-doc-authoring-1030
10
+
11
+#customer intent: As an administrator, I want to understand Microsoft Entra ID Protection risk detections so that I can identify suspicious activity in my organization.
1012
---
1113
1214
# What are risk detections?
⋯ 50 unchanged lines
6365
| [Microsoft Entra threat intelligence (user)](#microsoft-entra-threat-intelligence-user) | Real-time or Offline | Nonpremium | investigationsThreatIntelligence |
6466
| [Possible attempt to access Primary Refresh Token (PRT)](#possible-attempt-to-access-primary-refresh-token-prt) | Offline | Premium | attemptedPrtAccess |
6567
| [Suspicious API Traffic](#suspicious-api-traffic) | Offline | Premium | suspiciousAPITraffic |
66
−| [Suspicious credential addition](#suspicious-credential-addition) | Real-time | Premium | TBD |
68
+| [Suspicious credential addition](#suspicious-credential-addition) | Real-time | Premium | suspiciousCredentialAddition |
6769
| [Suspicious sending patterns](#suspicious-sending-patterns) | Offline | Premium | suspiciousSendingPatterns |
6870
| [User reported suspicious activity](#user-reported-suspicious-activity) | Offline | Premium | userReportedSuspiciousActivity |
6971
⋯ 233 unchanged lines
303305
304306
### Suspicious credential addition
305307
306
−<!-- TODO: Confirm the Premium license requirement and replace the TBD riskEventType in the user risk detections table before publishing. -->
307
−
308
−This detection identifies when a new authentication method is added to an account under suspicious circumstances. This might indicate that an attacker has accessed the account and is trying to maintain access by registering a new credential.
309
−
310
−Microsoft Entra ID Protection raises user risk when this activity is detected, allowing organizations to respond through their configured risk-based policies.
308
+This detection identifies when a new authentication method is added to an account under suspicious circumstances. This activity might indicate that an attacker has accessed the account and registered a new credential.
311309
312310
- Calculated in real-time
313311
- License requirement: Microsoft Entra ID P2
⋯ 16 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 22 Oct 00:00 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.