Identity Protection risk detections

Requirements, exceptions and scope

• GuidanceScope1 condition1 passage

  Microsoft Entra ID Protection can provide a broad range of risk detections that can be used to identify suspicious activity in your organization. The tables…

• Sign-in risk detections mapped to riskEventTypeRequirement1 condition1 passage
• Additional risk detected (sign-in)Exception1 condition1 passage
• Anomalous token (sign-in)Recommendation1 condition1 passage
• Atypical travelScope1 passage
• Impossible travelException1 passage
• Mass access to sensitive filesException2 conditions1 passage
• Microsoft Entra threat intelligence (sign-in)Scope1 passage
• Password sprayException2 conditions1 passage
• Unfamiliar sign-in propertiesRecommendation1 passage
• Additional risk detected (user)Exception1 condition1 passage
• Anomalous token (user)Recommendation1 condition1 passage
• Attacker in the MiddleScopeRecommendation3 conditions1 passage
• Leaked credentialsRequirementException3 conditions2 passages
• Microsoft Entra threat intelligence (user)Scope1 passage
• Possible attempt to access Primary Refresh Token (PRT)ExceptionRecommendation1 condition1 passage
• Suspicious sending patternsException2 conditions1 passage
• User reported suspicious activityRequirement1 condition1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

1. 18 Mar 2026
   No longer on the page Leaked credentialsMicrosoft's source, commit 00209f1
2. 18 Mar 2026
   Exception added Leaked credentialsMicrosoft's source, commit 00209f1
3. 17 Mar 2026
   Exception added Leaked credentialsMicrosoft's source, commit f14d966
4. 17 Mar 2026
   No longer on the page Leaked credentialsMicrosoft's source, commit f14d966
5. 17 Mar 2026
   No longer on the page Leaked credentialsMicrosoft's source, commit f14d966
6. 17 Mar 2026
   Requirement added Leaked credentialsMicrosoft's source, commit f14d966
7. 6 Mar 2026
   Exception added Leaked credentialsMicrosoft's source, commit efec434
8. 6 Mar 2026
   Exception added Password sprayMicrosoft's source, commit 4911b5e
9. 6 Mar 2026
   Scope added Microsoft Entra threat intelligence (sign-in)Microsoft's source, commit 4911b5e
10. 6 Mar 2026
    Scope added Microsoft Entra threat intelligence (user)Microsoft's source, commit 4911b5e
11. 6 Mar 2026
    Requirement added Leaked credentialsMicrosoft's source, commit 06d3826
12. 7 Jan 2026
    Requirement added User reported suspicious activityMicrosoft's source, commit 47783df