Microsoft Entra ID: Attacker in the Middle detection alert in ID Protection is GA
From Microsoft 365 Message Center Archive by Merill Fernando · Microsoft may not have sent this notice to your tenant.Rollout
Rollout dates are often only in the text. When Microsoft moves them, the change shows under "What changed".
What the notice says
Microsoft’s text, safely structuredThe Attacker in the Middle detection will be Generally Available for users in Microsoft Entra ID Protection.
When this will happen
General Availability (Worldwide): We will begin rolling out mid-August 2024 and expect to complete by late August 2024.
How this will affect your organization
This high-precision detection will be triggered on a user account that has been compromised by an adversary who has intercepted the user's credentials, including tokens issued to the user. The risk is identified through Microsoft 365 Defender and will elevate the user to high risk, triggering the configured Conditional Access policy.
What you need to do to prepare
Learn more: What are risks in Microsoft Entra ID Protection - Microsoft Entra ID Protection | Microsoft Learn
This rollout will happen automatically by the specified date with no admin action required before the rollout. You may want to notify your admins about this change and update any relevant documentation.
What changed
Between archive captures, newest firstThe archive supplies one version of this notice.
Learn more
Links from the notice and their documentation checksRelated public changes
- Official documentation · 22 Oct 2026Identity Protection risk detections Shared reference: https://learn.microsoft.com/entra/id-protection/concept-identity-protection-risks
- Public source · 14 Oct 2026MC1507808: Reminder: Microsoft‑managed CA policy will be enforced soon — Require risk remediation for high‑risk users Microsoft 365 Message Center Archive by Merill FernandoShared reference: https://learn.microsoft.com/entra/id-protection/concept-identity-protection-risks
- Public source · 21 Sep 2026MC1476122: Microsoft-managed CA policy coming to your tenant: Require risk remediation for high-risk users Microsoft 365 Message Center Archive by Merill FernandoShared reference: https://learn.microsoft.com/entra/id-protection/concept-identity-protection-risks
Not confirmed here
What this page cannot tell you- Whether your tenant is affected: this is Microsoft's notice, not a check of your settings.