Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 8d54ff2 · +15 −1 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Explore the full list of risk detections and their corresponding risk event types, along with a description of each risk event type.
44
ms.service: entra-id-protection
55
ms.topic: reference
6
−ms.date: 04/22/2026
6
+ms.date: 10/19/2026
77
ms.reviewer: lvandenende
8
+ai-usage: ai-assisted
9
+ms.custom: msecd-doc-authoring-1030
810
---
911
1012
# What are risk detections?
⋯ 50 unchanged lines
6163
| [Microsoft Entra threat intelligence (user)](#microsoft-entra-threat-intelligence-user) | Real-time or Offline | Nonpremium | investigationsThreatIntelligence |
6264
| [Possible attempt to access Primary Refresh Token (PRT)](#possible-attempt-to-access-primary-refresh-token-prt) | Offline | Premium | attemptedPrtAccess |
6365
| [Suspicious API Traffic](#suspicious-api-traffic) | Offline | Premium | suspiciousAPITraffic |
66
+| [Suspicious credential addition](#suspicious-credential-addition) | Real-time | Premium | TBD |
6467
| [Suspicious sending patterns](#suspicious-sending-patterns) | Offline | Premium | suspiciousSendingPatterns |
6568
| [User reported suspicious activity](#user-reported-suspicious-activity) | Offline | Premium | userReportedSuspiciousActivity |
6669
⋯ 229 unchanged lines
296299
This risk detection is reported when abnormal GraphAPI traffic or directory enumeration is observed. Suspicious API traffic might suggest that a user is compromised and conducting reconnaissance in the environment.
297300
298301
- Calculated offline
302
+- License requirement: Microsoft Entra ID P2
303
+
304
+### Suspicious credential addition
305
+
306
+<!-- TODO: Confirm the Premium license requirement and replace the TBD riskEventType in the user risk detections table before publishing. -->
307
+
308
+This detection identifies when a new authentication method is added to an account under suspicious circumstances. This might indicate that an attacker has accessed the account and is trying to maintain access by registering a new credential.
309
+
310
+Microsoft Entra ID Protection raises user risk when this activity is detected, allowing organizations to respond through their configured risk-based policies.
311
+
312
+- Calculated in real-time
299313
- License requirement: Microsoft Entra ID P2
300314
301315
### Suspicious sending patterns
⋯ 14 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 22 Oct 00:00 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.