Identity Protection risk detections

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidance

No content change seen yet. Watched since 8 Oct 23:13 UTC, last read 25 Oct 00:48 UTC, next check today 00:48 UTC. Microsoft's own edits are listed below.

Read the Microsoft source · Link to this observation · My radar

Timeline

From the capture of 8 Oct 23:13 UTC · an earlier observation

Legacy capture: table structure or oversized sections are unavailable for extraction

14 recorded changes

Microsoft's revision log on this page · 19 entries

Dates from the page's own change log or history section. They describe earlier edits, not upcoming policy.

What are risk detections?Scope1 condition
Sign-in risk detections mapped to riskEventTypeRequirement1 condition
Additional risk detected (sign-in)Exception1 condition
Anomalous token (sign-in)Recommendation1 condition
Atypical travelScope
Impossible travelException
Mass access to sensitive filesException2 conditions
Microsoft Entra threat intelligence (sign-in)Scope
Password sprayException2 conditions
Unfamiliar sign-in propertiesRecommendation
Additional risk detected (user)Exception1 condition
Anomalous token (user)Recommendation1 condition
Attacker in the MiddleScopeRecommendation3 conditions
Leaked credentialsException2 conditions
Leaked credentialsRequirement1 condition
Microsoft Entra threat intelligence (user)Scope
Possible attempt to access Primary Refresh Token (PRT)ExceptionRecommendation1 condition
Suspicious sending patternsException2 conditions
User reported suspicious activityRequirement1 condition

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

18 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit 00209f1
18 Mar 2026
Exception added Leaked credentials Microsoft's source, commit 00209f1
17 Mar 2026
Exception added Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit f14d966
6 Mar 2026
Exception added Leaked credentials Microsoft's source, commit efec434
6 Mar 2026
Exception added Password spray Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (sign-in)Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (user)Microsoft's source, commit 4911b5e
6 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit 06d3826
7 Jan 2026
Requirement added User reported suspicious activity Microsoft's source, commit 47783df

2 earlier changes

7 Oct 2025
No longer on the page Attacker in the Middle Microsoft's source, commit 325b444
7 Oct 2025
Scope added Attacker in the Middle Microsoft's source, commit 325b444

Observed history and review priority

Captured 8 Oct 23:13 UTC; extracted 22 Oct 18:57 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d/legacy.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 23

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

24 Oct 00:41 UTC · 21 candidates
22 Oct 00:17 UTC · 21 candidates
21 Oct 13:23 UTC · 21 candidates
19 Oct 18:15 UTC · 21 candidates
18 Oct 23:50 UTC · 21 candidates
15 Oct 19:43 UTC · 21 candidates
15 Oct 19:28 UTC · 21 candidates
12 Oct 23:53 UTC · 21 candidates
8 Oct 23:13 UTC · 21 candidates
23 Apr 19:04 UTC · 21 candidates
22 Apr 20:53 UTC · 21 candidates
22 Apr 20:47 UTC · 21 candidates
22 Apr 19:24 UTC · 21 candidates
18 Mar 15:47 UTC · 21 candidates
17 Mar 22:09 UTC · 21 candidates
6 Mar 20:27 UTC · 21 candidates
6 Mar 18:13 UTC · 20 candidates
6 Mar 17:22 UTC · 17 candidates
7 Jan 21:01 UTC · 16 candidates
7 Oct 2025 16:58 UTC · 15 candidates
2 Oct 2025 21:16 UTC · 15 candidates
11 Sep 2025 23:31 UTC · 15 candidates
11 Sep 2025 23:24 UTC · 15 candidates

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read 25 Oct 00:32 UTC.

21 Oct 13:23 UTC Update suspicious credential detection details Served on LearnView diff
19 Oct 18:15 UTC Add suspicious credential addition detection View diff
15 Oct 19:43 UTC Update atypical travel detection table View diff
15 Oct 19:28 UTC Update atypical travel detection details View diff
23 Apr 19:04 UTC rename-detection View diff
22 Apr 20:53 UTC added-risk-level View diff
22 Apr 20:47 UTC revision View diff
22 Apr 19:24 UTC Add Authenticator-assisted phishing detection (preview) to risk detections View diff
18 Mar 15:47 UTC added-link-to-MDI View diff
17 Mar 22:09 UTC PM-updates View diff
6 Mar 20:27 UTC faqs View diff
6 Mar 18:13 UTC updates View diff
6 Mar 17:22 UTC idp-updates-030626 View diff
7 Jan 21:01 UTC idp-risky-users-010725 View diff
7 Oct 2025 16:58 UTC PR-review-fixes View diff
2 Oct 2025 21:16 UTC link-fixes View diff
11 Sep 2025 23:31 UTC missed-detection View diff
11 Sep 2025 23:24 UTC idp-licenses-091125 View diff
12 Aug 2025 21:52 UTC fix View diff
12 Aug 2025 19:15 UTC idp-081225 View diff

4 metadata-only edits · author, dates or topic labels, no article text

19 Feb 16:47 UTC Merge branch 'main' into copilot/reclassify-ms-topic-values-batch-6 Metadata onlyView diff
10 Feb 17:55 UTC [BULK UPDATE] Moves author/ms.author/ms.service out of individual file and to folder level in docfx.json. Metadata onlyView diff
3 Feb 18:50 UTC Moves manager from individual files to folder level in docfx.json. Metadata onlyView diff
27 Jan 00:21 UTC Reclassify ms.topic values batch 6 (entries 201 to 225) Metadata onlyView diff

Retained observations

24 Oct 00:41 UTC
Source metadata changed; retained article content is unchanged.
22 Oct 00:17 UTC
2 new passages (about 40 words), 1 edited passage (6 words changed). The changed wording mentions settings and controls. Review the source to confirm the effect.
18 Oct 23:50 UTC
1 new passage (12 words), 1 edited passage (1 word changed), 1 removed passage (about 50 words). No rule matched the changed words; review the source for its effect.
12 Oct 23:53 UTC
The page title or its body outside the tracked passages changed. Review the source for its effect.
8 Oct 23:13 UTC · shown above

What changed

First observed 18 Oct 2026

No field changes are shown for this selection.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.