Identity Protection risk detections
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit f6b02dd · +2 −2 lines · also on GitHub
⋯ 119 unchanged lines
120120
121121
This risk detection type identifies two sign-ins originating from geographically distant locations, where at least one of the locations might also be atypical for the user, given past behavior. The algorithm takes into account multiple factors including the time between the two sign-ins and the time it would take for the user to travel from the first location to the second. This risk might indicate that a different user is using the same credentials.
122122
123
−The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.
123
+The system uses adaptive learning to learn a new user's sign-in behavior.
124124
125
−- Calculated offline
125
+- Calculated in real-time
126126
- License requirement: Microsoft Entra ID P2
127127
- [Tips for investigating atypical travel detections.](howto-identity-protection-investigate-risk.md#atypical-travel-detections)
128128
⋯ 187 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 18 Oct 23:34 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.