Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit d733a1d · +1 −1 lines · also on GitHub
⋯ 78 unchanged lines
7979
8080
### Authenticator-assisted phishing detection
8181
82
−This detection identifies sign-ins where unfamiliar properties such as ASN, browser, device, and GPS location data indicate a potential social engineering or phishing attack. The detection fires during sessions that use a password *and* multifactor authentication (MFA) *plus* telemetry from the Microsoft Authenticator app. The combination of these signals helps to increase the precision of the detection. Location proximity between the authentication *requesting* device and the authentication *approving* device is analyzed by Microsoft Entra ID to help distinguish legitimate sign-ins from attacker-initiated sessions.
82
+This detection identifies sign-ins where unfamiliar properties such as ASN, browser, device, and GPS location data indicate a potential social engineering or phishing attack. The detection fires during sessions that use a *Password + MFA* authentication method *plus* telemetry from the Microsoft Authenticator app. The combination of these signals helps to increase the precision of the detection and flags the sign-in attempt as **High risk**. Location proximity between the authentication *requesting* device and the authentication *approving* device is analyzed by Microsoft Entra ID to help distinguish legitimate sign-ins from attacker-initiated sessions.
8383
8484
- Calculated in real-time
8585
- License requirement: Microsoft Entra ID P2
⋯ 230 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.