Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f14d966 · +4 −4 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Explore the full list of risk detections and their corresponding risk event types, along with a description of each risk event type.
44
ms.service: entra-id-protection
55
ms.topic: reference
6
−ms.date: 01/07/2026
7
−ms.reviewer: cokoopma
6
+ms.date: 03/17/2026
7
+ms.reviewer: lvandenende
88
---
99
1010
# What are risk detections?
⋯ 248 unchanged lines
259259
260260
### Leaked credentials
261261
262
−This risk detection indicates that a user's valid credentials appeared in a known credential breach. Microsoft operates a large-scale credential scanning pipeline that continuously monitors dark web forums, breach dump repositories, paste sites, law enforcement seizure data, and other sources through partnerships with the Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Crimes Unit (DCU), and industry partners. When discovered credentials are found, the service validates the actual credential material against your tenant's current valid password hashes. A detection is only emitted when a confirmed match is found. This detection is always as **high** risk because it represents verified credential exposure, not a heuristic signal. A cloud-based password reset through Microsoft Entra remediates the user risk for this detection.
262
+This risk detection indicates that a user's valid credentials appeared in a known credential breach. Microsoft operates a large-scale credential scanning pipeline that continuously monitors dark web forums, breach dump repositories, paste sites, law enforcement seizure data, and other sources through partnerships with the Microsoft Threat Intelligence Center (MSTIC), Microsoft Digital Crimes Unit (DCU), and industry partners. When discovered credentials are found, the service validates the actual credential material against your tenant's current valid password hashes. A detection is only emitted when a confirmed match is found. This detection is always as **high** risk because it represents verified credential exposure, not a heuristic signal. A cloud-based password reset through Microsoft Entra remediates the user risk for this detection for cloud and on-premises passwords, as long as password hash synchronization (PHS) is enabled for on-premises passwords.
263263
264264
- Calculated offline
265265
- License requirement: Microsoft Entra ID Free or Microsoft Entra ID P1
266
−- Requires [password hash synchronization (PHS)](../identity/hybrid/connect/how-to-connect-password-hash-synchronization.md)
266
+- Requires [password hash synchronization (PHS)](../identity/hybrid/connect/how-to-connect-password-hash-synchronization.md) for on-premises passwords
267267
- [Tips for investigating leaked credentials detections.](howto-identity-protection-investigate-risk.md#leaked-credentials-detections)
268268
269269
### Microsoft Entra threat intelligence (user)
⋯ 38 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 06:04 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.