Identity Protection risk detections

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidanceObserved changes retained

Retained observation

Source metadata changed; retained article content is unchanged.

Documentation metadata only

Read the current Microsoft source · Link to this observation · Compare any two versions

Observation details · observed 24 Oct 00:41 UTC

Observed by ChangeIntel: 24 Oct 00:41 UTC
Source update metadata: 21 Oct 17:44 UTC
First observed on this installation: 8 Oct 23:13 UTC
Last successful check: 25 Oct 00:48 UTC
Next check due: today 00:48 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

Watch this page to review its changes in My radar.

Timeline

From the capture of 24 Oct 00:41 UTC

18 undated sections
14 with conditions
14 recorded changes

Requirements, exceptions and scope

GuidanceScope1 condition1 passage
Microsoft Entra ID Protection can provide a broad range of risk detections that can be used to identify suspicious activity in your organization. The tables…
Sign-in risk detections mapped to riskEventTypeRequirement1 condition1 passage
Additional risk detected (sign-in)Exception1 condition1 passage
Anomalous token (sign-in)Recommendation1 condition1 passage
Atypical travelScope1 passage
Impossible travelException1 passage
Mass access to sensitive filesException2 conditions1 passage
Microsoft Entra threat intelligence (sign-in)Scope1 passage
Password sprayException2 conditions1 passage
Unfamiliar sign-in propertiesRecommendation1 passage
Additional risk detected (user)Exception1 condition1 passage
Anomalous token (user)Recommendation1 condition1 passage
Attacker in the MiddleScopeRecommendation3 conditions1 passage
Leaked credentialsRequirementException3 conditions2 passages
Microsoft Entra threat intelligence (user)Scope1 passage
Possible attempt to access Primary Refresh Token (PRT)ExceptionRecommendation1 condition1 passage
Suspicious sending patternsException2 conditions1 passage
User reported suspicious activityRequirement1 condition1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

18 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit 00209f1
18 Mar 2026
Exception added Leaked credentials Microsoft's source, commit 00209f1
17 Mar 2026
Exception added Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit f14d966
6 Mar 2026
Exception added Leaked credentials Microsoft's source, commit efec434
6 Mar 2026
Exception added Password spray Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (sign-in)Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (user)Microsoft's source, commit 4911b5e
6 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit 06d3826
7 Jan 2026
Requirement added User reported suspicious activity Microsoft's source, commit 47783df

2 earlier changes

7 Oct 2025
No longer on the page Attacker in the Middle Microsoft's source, commit 325b444
7 Oct 2025
Scope added Attacker in the Middle Microsoft's source, commit 325b444

Observed history and review priority

Captured 24 Oct 00:41 UTC; extracted 24 Oct 00:41 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.

Review priority. Extracted assertions require review · Applicability or exceptions require review

0 date changes and 0 condition changes across 3 compared revisions. Suggested check interval: 24 hours.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 23

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

24 Oct 00:41 UTC · 21 candidates
22 Oct 00:17 UTC · 21 candidates
21 Oct 13:23 UTC · 21 candidates
19 Oct 18:15 UTC · 21 candidates
18 Oct 23:50 UTC · 21 candidates
15 Oct 19:43 UTC · 21 candidates
15 Oct 19:28 UTC · 21 candidates
12 Oct 23:53 UTC · 21 candidates
8 Oct 23:13 UTC · 21 candidates
23 Apr 19:04 UTC · 21 candidates
22 Apr 20:53 UTC · 21 candidates
22 Apr 20:47 UTC · 21 candidates
22 Apr 19:24 UTC · 21 candidates
18 Mar 15:47 UTC · 21 candidates
17 Mar 22:09 UTC · 21 candidates
6 Mar 20:27 UTC · 21 candidates
6 Mar 18:13 UTC · 20 candidates
6 Mar 17:22 UTC · 17 candidates
7 Jan 21:01 UTC · 16 candidates
7 Oct 2025 16:58 UTC · 15 candidates
2 Oct 2025 21:16 UTC · 15 candidates
11 Sep 2025 23:31 UTC · 15 candidates
11 Sep 2025 23:24 UTC · 15 candidates

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read 25 Oct 00:32 UTC.

21 Oct 13:23 UTC Update suspicious credential detection details Served on LearnView diff
19 Oct 18:15 UTC Add suspicious credential addition detection View diff
15 Oct 19:43 UTC Update atypical travel detection table View diff
15 Oct 19:28 UTC Update atypical travel detection details View diff
23 Apr 19:04 UTC rename-detection View diff
22 Apr 20:53 UTC added-risk-level View diff
22 Apr 20:47 UTC revision View diff
22 Apr 19:24 UTC Add Authenticator-assisted phishing detection (preview) to risk detections View diff
18 Mar 15:47 UTC added-link-to-MDI View diff
17 Mar 22:09 UTC PM-updates View diff
6 Mar 20:27 UTC faqs View diff
6 Mar 18:13 UTC updates View diff
6 Mar 17:22 UTC idp-updates-030626 View diff
7 Jan 21:01 UTC idp-risky-users-010725 View diff
7 Oct 2025 16:58 UTC PR-review-fixes View diff
2 Oct 2025 21:16 UTC link-fixes View diff
11 Sep 2025 23:31 UTC missed-detection View diff
11 Sep 2025 23:24 UTC idp-licenses-091125 View diff
12 Aug 2025 21:52 UTC fix View diff
12 Aug 2025 19:15 UTC idp-081225 View diff

4 metadata-only edits · author, dates or topic labels, no article text

19 Feb 16:47 UTC Merge branch 'main' into copilot/reclassify-ms-topic-values-batch-6 Metadata onlyView diff
10 Feb 17:55 UTC [BULK UPDATE] Moves author/ms.author/ms.service out of individual file and to folder level in docfx.json. Metadata onlyView diff
3 Feb 18:50 UTC Moves manager from individual files to folder level in docfx.json. Metadata onlyView diff
27 Jan 00:21 UTC Reclassify ms.topic values batch 6 (entries 201 to 225) Metadata onlyView diff

No related evidence found in this installation's recent collection. This does not establish that no announcement exists.

Retained observations

24 Oct 00:41 UTC · shown above
22 Oct 00:17 UTC
2 new passages (about 40 words), 1 edited passage (6 words changed). The changed wording mentions settings and controls. Review the source to confirm the effect.
18 Oct 23:50 UTC
1 new passage (12 words), 1 edited passage (1 word changed), 1 removed passage (about 50 words). No rule matched the changed words; review the source for its effect.
12 Oct 23:53 UTC
The page title or its body outside the tracked passages changed. Review the source for its effect.
8 Oct 23:13 UTC
Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes are shown for this selection.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.