Identity Protection risk detections

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidanceObserved changes retained

Observed content change

2 new passages (about 40 words), 1 edited passage (6 words changed). The changed wording mentions settings and controls. Review the source to confirm the effect.

May need admin actionCheck the settings the wording names.

Effect uncertain

EditedUser risk detections mapped to riskEventType

… Attacker in the Middle Offline Premium attackerinTheMiddle Leaked credentials Offline Nonpremium leakedCredentials Microsoft Entra threat intelligence (user) Real-time or Offline Nonpremium investigationsThreatIntelligence Possible attempt to access Primary Refresh Token (PRT) Offline Premium attemptedPrtAccess Suspicious API Traffic Offline Premium suspiciousAPITraffic Suspicious [added: credential addition Real-time Premium suspiciousCredentialAddition Suspicious] sending patterns Offline Premium suspiciousSendingPatterns User reported suspicious activity Offline Premium userReportedSuspiciousActivity

NewSuspicious credential addition

[added: This detection identifies when a new authentication method is added to an account under suspicious circumstances. This activity might indicate that an attacker has accessed the account and registered a new credential.]

Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.

Read the current Microsoft source · Link to this observation · Compare any two versions

Sections to inspect

Up to 12 section headings from retained before/after evidence. The current source may have changed again.

Why this was flagged

The changed words, with a few words around them, matched these rule categories: settings and controls. These matches identify subjects to assess; they do not establish a policy change or applicability.

Observation details · observed 22 Oct 00:17 UTC

Observed by ChangeIntel: 22 Oct 00:17 UTC
Source update metadata: 21 Oct 17:44 UTC
Microsoft's latest commit in that period: Update suspicious credential detection details · committed 21 Oct 13:23 UTC · View diff
First observed on this installation: 8 Oct 23:13 UTC
Last successful check: today 00:48 UTC
Next check due: 26 Oct 00:48 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

This is an earlier observation; review the latest in My radar.

Timeline

From the capture of 22 Oct 00:17 UTC · an earlier observation

18 undated sections
14 with conditions
14 recorded changes

Requirements, exceptions and scope

GuidanceScope1 condition1 passage
Sign-in risk detections mapped to riskEventTypeRequirement1 condition1 passage
Additional risk detected (sign-in)Exception1 condition1 passage
Anomalous token (sign-in)Recommendation1 condition1 passage
Atypical travelScope1 passage
Impossible travelException1 passage
Mass access to sensitive filesException2 conditions1 passage
Microsoft Entra threat intelligence (sign-in)Scope1 passage
Password sprayException2 conditions1 passage
Unfamiliar sign-in propertiesRecommendation1 passage
Additional risk detected (user)Exception1 condition1 passage
Anomalous token (user)Recommendation1 condition1 passage
Attacker in the MiddleScopeRecommendation3 conditions1 passage
Leaked credentialsRequirementException3 conditions2 passages
Microsoft Entra threat intelligence (user)Scope1 passage
Possible attempt to access Primary Refresh Token (PRT)ExceptionRecommendation1 condition1 passage
Suspicious sending patternsException2 conditions1 passage
User reported suspicious activityRequirement1 condition1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

18 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit 00209f1
18 Mar 2026
Exception added Leaked credentials Microsoft's source, commit 00209f1
17 Mar 2026
Exception added Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit f14d966
6 Mar 2026
Exception added Leaked credentials Microsoft's source, commit efec434
6 Mar 2026
Exception added Password spray Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (sign-in)Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (user)Microsoft's source, commit 4911b5e
6 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit 06d3826
7 Jan 2026
Requirement added User reported suspicious activity Microsoft's source, commit 47783df

2 earlier changes

7 Oct 2025
No longer on the page Attacker in the Middle Microsoft's source, commit 325b444
7 Oct 2025
Scope added Attacker in the Middle Microsoft's source, commit 325b444

Observed history and review priority

Captured 22 Oct 00:17 UTC; extracted 22 Oct 18:57 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 23

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

24 Oct 00:41 UTC · 21 candidates
22 Oct 00:17 UTC · 21 candidates
21 Oct 13:23 UTC · 21 candidates
19 Oct 18:15 UTC · 21 candidates
18 Oct 23:50 UTC · 21 candidates
15 Oct 19:43 UTC · 21 candidates
15 Oct 19:28 UTC · 21 candidates
12 Oct 23:53 UTC · 21 candidates
8 Oct 23:13 UTC · 21 candidates
23 Apr 19:04 UTC · 21 candidates
22 Apr 20:53 UTC · 21 candidates
22 Apr 20:47 UTC · 21 candidates
22 Apr 19:24 UTC · 21 candidates
18 Mar 15:47 UTC · 21 candidates
17 Mar 22:09 UTC · 21 candidates
6 Mar 20:27 UTC · 21 candidates
6 Mar 18:13 UTC · 20 candidates
6 Mar 17:22 UTC · 17 candidates
7 Jan 21:01 UTC · 16 candidates
7 Oct 2025 16:58 UTC · 15 candidates
2 Oct 2025 21:16 UTC · 15 candidates
11 Sep 2025 23:31 UTC · 15 candidates
11 Sep 2025 23:24 UTC · 15 candidates

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read today 00:32 UTC.

21 Oct 13:23 UTC Update suspicious credential detection details Served on LearnView diff
19 Oct 18:15 UTC Add suspicious credential addition detection View diff
15 Oct 19:43 UTC Update atypical travel detection table View diff
15 Oct 19:28 UTC Update atypical travel detection details View diff
23 Apr 19:04 UTC rename-detection View diff
22 Apr 20:53 UTC added-risk-level View diff
22 Apr 20:47 UTC revision View diff
22 Apr 19:24 UTC Add Authenticator-assisted phishing detection (preview) to risk detections View diff
18 Mar 15:47 UTC added-link-to-MDI View diff
17 Mar 22:09 UTC PM-updates View diff
6 Mar 20:27 UTC faqs View diff
6 Mar 18:13 UTC updates View diff
6 Mar 17:22 UTC idp-updates-030626 View diff
7 Jan 21:01 UTC idp-risky-users-010725 View diff
7 Oct 2025 16:58 UTC PR-review-fixes View diff
2 Oct 2025 21:16 UTC link-fixes View diff
11 Sep 2025 23:31 UTC missed-detection View diff
11 Sep 2025 23:24 UTC idp-licenses-091125 View diff
12 Aug 2025 21:52 UTC fix View diff
12 Aug 2025 19:15 UTC idp-081225 View diff

4 metadata-only edits · author, dates or topic labels, no article text

19 Feb 16:47 UTC Merge branch 'main' into copilot/reclassify-ms-topic-values-batch-6 Metadata onlyView diff
10 Feb 17:55 UTC [BULK UPDATE] Moves author/ms.author/ms.service out of individual file and to folder level in docfx.json. Metadata onlyView diff
3 Feb 18:50 UTC Moves manager from individual files to folder level in docfx.json. Metadata onlyView diff
27 Jan 00:21 UTC Reclassify ms.topic values batch 6 (entries 201 to 225) Metadata onlyView diff

Retained observations

24 Oct 00:41 UTC
Source metadata changed; retained article content is unchanged.
22 Oct 00:17 UTC · shown above
18 Oct 23:50 UTC
1 new passage (12 words), 1 edited passage (1 word changed), 1 removed passage (about 50 words). No rule matched the changed words; review the source for its effect.
12 Oct 23:53 UTC
The page title or its body outside the tracked passages changed. Review the source for its effect.
8 Oct 23:13 UTC
Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes are shown for this selection.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.