Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit ca63353 · +12 −1 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Explore the full list of risk detections and their corresponding risk event types, along with a description of each risk event type.
44
ms.service: entra-id-protection
55
ms.topic: reference
6
−ms.date: 03/17/2026
6
+ms.date: 04/22/2026
77
ms.reviewer: lvandenende
88
---
99
⋯ 16 unchanged lines
2626
| Sign-in risk detection | Detection type | Type | riskEventType |
2727
| --- | --- | --- | --- |
2828
| [Activity from anonymous IP address](#activity-from-anonymous-ip-address) | Offline | Premium | riskyIPAddress |
29
+| [Authenticator-assisted phishing detection (preview)](#authenticator-assisted-phishing-detection-preview) | Real-time | Premium | authenticatorPhishing |
2930
| [Additional risk detected (sign-in)](#additional-risk-detected-sign-in) | Real-time or Offline | Nonpremium | generic ^ |
3031
| [Admin confirmed user compromised](#admin-confirmed-user-compromised) | Offline | Nonpremium | adminConfirmedUserCompromised |
3132
| [Anomalous Token (sign-in)](#anomalous-token-sign-in) | Real-time or Offline | Premium | anomalousToken |
⋯ 43 unchanged lines
7576
- License requirement:
7677
- Microsoft Entra ID P2 and a standalone license for Microsoft Defender for Cloud Apps
7778
- Microsoft 365 E5 with Enterprise Mobility + Security E5
79
+
80
+### Authenticator-assisted phishing detection (preview)
81
+
82
+> [!NOTE]
83
+> This feature is currently in preview. For more information about previews, see [Universal License Terms For Online Services](https://www.microsoft.com/licensing/terms/product/ForOnlineServices/all).
84
+
85
+This detection identifies sign-ins where unfamiliar properties such as ASN, browser, device, and GPS location data indicate a potential social engineering or phishing attack. The detection fires during sessions that use Password plus multifactor authentication (MFA) and uses telemetry from the Microsoft Authenticator app to increase signal precision. Location proximity between the authentication requesting device and the authentication approving device is analyzed to help distinguish legitimate sign-ins from attacker-initiated sessions.
86
+
87
+- Calculated in real-time
88
+- License requirement: Microsoft Entra ID P2
7889
7990
### Additional risk detected (sign-in)
8091
⋯ 227 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.