-
Entra ID Protection - Risk Detection - Sign-in Risk
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Use Case: Identity and Access Audit Use Case: Threat Detection Use Case: Risk Detection Tactic: Initial Access Resources: Investigation Guide Noise: Medium Performance: Normal Rule Type: Custom Query (KQL) Platform: Entra ID Data Source: Entra ID Protection Logs ·Identifies sign-in risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects sign-in activity such as anonymized IP addresses, unlikely travel, password spray, and more.
Read More -
Entra ID Protection - Risk Detection - User Risk
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Use Case: Identity and Access Audit Use Case: Threat Detection Use Case: Risk Detection Tactic: Initial Access Resources: Investigation Guide Noise: Low Performance: Normal Rule Type: Custom Query (KQL) Platform: Entra ID Data Source: Entra ID Protection Logs ·Identifies user risk detection events via Microsofts Entra ID Protection service. Entra ID Protection detects user risk activity such as anonymized IP addresses, unlikely travel, password spray, and more.
Read More -
Entra ID Protection Admin Confirmed Compromise
Sep 19, 2026 · Domain: Cloud Domain: Identity Data Source: Azure Data Source: Entra ID Data Source: Entra ID Protection Logs Use Case: Identity and Access Audit Use Case: Threat Detection Tactic: Initial Access Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Rule Type: Custom Query (KQL) Platform: Entra ID ·Identifies when an administrator has manually confirmed a user or sign-in as compromised in Microsoft Entra ID Protection. This indicates that an administrator has reviewed the risk detection and determined that the user account or sign-in activity is definitively compromised. This is a high-confidence indicator of account compromise and should be investigated immediately.
Read More