Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit efec434 · +1 −1 lines · also on GitHub
⋯ 258 unchanged lines
259259
260260
### Leaked credentials
261261
262
−This risk detection indicates that a user's valid credentials appeared in a known credential breach. Microsoft operates a large-scale credential scanning pipeline that continuously monitors dark web forums, breach dump repositories, paste sites, law enforcement seizure data, and other sources through partnerships with the Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Crimes Unit (DCU), and industry partners. When discovered credentials match a user's current valid password hash, the user is flagged with **high** risk because the detection represents confirmed credential exposure.
262
+This risk detection indicates that a user's valid credentials appeared in a known credential breach. Microsoft operates a large-scale credential scanning pipeline that continuously monitors dark web forums, breach dump repositories, paste sites, law enforcement seizure data, and other sources through partnerships with the Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Crimes Unit (DCU), and industry partners. When discovered credentials are found, the service validates the actual credential material against your tenant's current valid password hashes. A detection is only emitted when a confirmed match is found. This detection is always as **high** risk because it represents verified credential exposure, not a heuristic signal. A cloud-based password reset through Microsoft Entra remediates the user risk for this detection.
263263
264264
- Calculated offline
265265
- License requirement: Microsoft Entra ID Free or Microsoft Entra ID P1
⋯ 42 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.