Identity Protection risk detections

Timelines and exceptions · All guidance changes

Entra · Official Microsoft guidanceObserved changes retained

Observed content change

1 new passage (12 words), 1 edited passage (1 word changed), 1 removed passage (about 50 words). No rule matched the changed words; review the source for its effect.

Read to decideThe wording changed without matching a rule; read the changed passages to decide.

Effect uncertain

EditedSign-in risk detections mapped to riskEventType

… Suspicious MFA authentication approval Real-time Premium authenticatorPhishing Additional risk detected (sign-in) Real-time or Offline Nonpremium generic ^ Admin confirmed user compromised Offline Nonpremium adminConfirmedUserCompromised Anomalous Token (sign-in) Real-time or Offline Premium anomalousToken Anonymous IP address Real-time Nonpremium anonymizedIPAddress Atypical travel ~~[removed: Offline]~~ [added: Real-time] Premium unlikelyTravel Impossible travel Offline Premium mcasImpossibleTravel Malicious IP address Offline Premium maliciousIPAddress Mass Access to Sensitive Files Offline Premium mcasFinSuspiciousFileAccess Microsoft Entra threat intelligence (sign-in) Real-time or Offline Nonpremium investigationsThreatIntelligence New country Offline Premium newCountry Password spray Real-time or …

NewAtypical travel

[added: The system uses adaptive learning to learn a new user's sign-in behavior.]

RemovedAtypical travel

[removed: The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior.]

Microsoft's wording from Microsoft source, © Microsoft Corporation, under MIT. ChangeIntel marks removed and added words, drops formatting and shortens long unchanged stretches.

Read the current Microsoft source · Link to this observation · Compare any two versions

Sections to inspect

Up to 12 section headings from retained before/after evidence. The current source may have changed again.

Observation details · observed 18 Oct 23:50 UTC

Observed by ChangeIntel: 18 Oct 23:50 UTC
Source update metadata: 15 Oct 22:51 UTC
Microsoft's latest commit in that period: Update atypical travel detection table · committed 15 Oct 19:43 UTC · View diff
First observed on this installation: 8 Oct 23:13 UTC
Last successful check: today 00:51 UTC
Next check due: 27 Oct 00:51 UTC

Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.

This is an earlier observation; review the latest in My radar.

Timeline

From the capture of 18 Oct 23:50 UTC · an earlier observation

18 undated sections
14 with conditions
14 recorded changes

Requirements, exceptions and scope

GuidanceScope1 condition1 passage
Sign-in risk detections mapped to riskEventTypeRequirement1 condition1 passage
Additional risk detected (sign-in)Exception1 condition1 passage
Anomalous token (sign-in)Recommendation1 condition1 passage
Atypical travelScope1 passage
Impossible travelException1 passage
Mass access to sensitive filesException2 conditions1 passage
Microsoft Entra threat intelligence (sign-in)Scope1 passage
Password sprayException2 conditions1 passage
Unfamiliar sign-in propertiesRecommendation1 passage
Additional risk detected (user)Exception1 condition1 passage
Anomalous token (user)Recommendation1 condition1 passage
Attacker in the MiddleScopeRecommendation3 conditions1 passage
Leaked credentialsRequirementException3 conditions2 passages
Microsoft Entra threat intelligence (user)Scope1 passage
Possible attempt to access Primary Refresh Token (PRT)ExceptionRecommendation1 condition1 passage
Suspicious sending patternsException2 conditions1 passage
User reported suspicious activityRequirement1 condition1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

18 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit 00209f1
18 Mar 2026
Exception added Leaked credentials Microsoft's source, commit 00209f1
17 Mar 2026
Exception added Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
No longer on the page Leaked credentials Microsoft's source, commit f14d966
17 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit f14d966
6 Mar 2026
Exception added Leaked credentials Microsoft's source, commit efec434
6 Mar 2026
Exception added Password spray Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (sign-in)Microsoft's source, commit 4911b5e
6 Mar 2026
Scope added Microsoft Entra threat intelligence (user)Microsoft's source, commit 4911b5e
6 Mar 2026
Requirement added Leaked credentials Microsoft's source, commit 06d3826
7 Jan 2026
Requirement added User reported suspicious activity Microsoft's source, commit 47783df

2 earlier changes

7 Oct 2025
No longer on the page Attacker in the Middle Microsoft's source, commit 325b444
7 Oct 2025
Scope added Attacker in the Middle Microsoft's source, commit 325b444

Observed history and review priority

Captured 18 Oct 23:50 UTC; extracted 22 Oct 18:57 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.

Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.

Retained observations · 23

Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.

24 Oct 00:41 UTC · 21 candidates
22 Oct 00:17 UTC · 21 candidates
21 Oct 13:23 UTC · 21 candidates
19 Oct 18:15 UTC · 21 candidates
18 Oct 23:50 UTC · 21 candidates
15 Oct 19:43 UTC · 21 candidates
15 Oct 19:28 UTC · 21 candidates
12 Oct 23:53 UTC · 21 candidates
8 Oct 23:13 UTC · 21 candidates
23 Apr 19:04 UTC · 21 candidates
22 Apr 20:53 UTC · 21 candidates
22 Apr 20:47 UTC · 21 candidates
22 Apr 19:24 UTC · 21 candidates
18 Mar 15:47 UTC · 21 candidates
17 Mar 22:09 UTC · 21 candidates
6 Mar 20:27 UTC · 21 candidates
6 Mar 18:13 UTC · 20 candidates
6 Mar 17:22 UTC · 17 candidates
7 Jan 21:01 UTC · 16 candidates
7 Oct 2025 16:58 UTC · 15 candidates
2 Oct 2025 21:16 UTC · 15 candidates
11 Sep 2025 23:31 UTC · 15 candidates
11 Sep 2025 23:24 UTC · 15 candidates

Microsoft's edits

History on GitHub

Commits to the page's source in MicrosoftDocs/entra-docs, with Microsoft's own messages. Commit dates can be hours or days before Learn publishes the change. ChangeIntel keeps a copy of each diff, so an edit stays readable here if GitHub stops serving it. Read today 00:34 UTC.

21 Oct 13:23 UTC Update suspicious credential detection details Served on LearnView diff
19 Oct 18:15 UTC Add suspicious credential addition detection View diff
15 Oct 19:43 UTC Update atypical travel detection table View diff
15 Oct 19:28 UTC Update atypical travel detection details View diff
23 Apr 19:04 UTC rename-detection View diff
22 Apr 20:53 UTC added-risk-level View diff
22 Apr 20:47 UTC revision View diff
22 Apr 19:24 UTC Add Authenticator-assisted phishing detection (preview) to risk detections View diff
18 Mar 15:47 UTC added-link-to-MDI View diff
17 Mar 22:09 UTC PM-updates View diff
6 Mar 20:27 UTC faqs View diff
6 Mar 18:13 UTC updates View diff
6 Mar 17:22 UTC idp-updates-030626 View diff
7 Jan 21:01 UTC idp-risky-users-010725 View diff
7 Oct 2025 16:58 UTC PR-review-fixes View diff
2 Oct 2025 21:16 UTC link-fixes View diff
11 Sep 2025 23:31 UTC missed-detection View diff
11 Sep 2025 23:24 UTC idp-licenses-091125 View diff
12 Aug 2025 21:52 UTC fix View diff
12 Aug 2025 19:15 UTC idp-081225 View diff

4 metadata-only edits · author, dates or topic labels, no article text

19 Feb 16:47 UTC Merge branch 'main' into copilot/reclassify-ms-topic-values-batch-6 Metadata onlyView diff
10 Feb 17:55 UTC [BULK UPDATE] Moves author/ms.author/ms.service out of individual file and to folder level in docfx.json. Metadata onlyView diff
3 Feb 18:50 UTC Moves manager from individual files to folder level in docfx.json. Metadata onlyView diff
27 Jan 00:21 UTC Reclassify ms.topic values batch 6 (entries 201 to 225) Metadata onlyView diff

Retained observations

24 Oct 00:41 UTC
Source metadata changed; retained article content is unchanged.
22 Oct 00:17 UTC
2 new passages (about 40 words), 1 edited passage (6 words changed). The changed wording mentions settings and controls. Review the source to confirm the effect.
18 Oct 23:50 UTC · shown above
12 Oct 23:53 UTC
The page title or its body outside the tracked passages changed. Review the source for its effect.
8 Oct 23:13 UTC
Baseline for retained history; no earlier retained text to compare.

What changed

First observed 18 Oct 2026

No field changes are shown for this selection.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.