Lesson 5 — Risky Users and Risky Sign-ins
A successful sign-in does not automatically mean the activity is trustworthy.
Microsoft Entra ID Protection continuously evaluates identity signals before, during and after authentication to determine whether a user account may be compromised or whether a specific sign-in appears suspicious.
This lesson explains user risk, sign-in risk, risk detections, remediation policies and the investigation workflow analysts use to determine whether risky identity activity represents genuine compromise.
What you will learn
This lesson explains how Microsoft Entra identifies identity risk and how analysts investigate suspected compromise.
Learning objectives
After completing this lesson, you should be able to interpret Microsoft Entra identity risk and investigate suspicious sign-in activity.
- Explain Microsoft Entra ID Protection.
- Differentiate user risk from sign-in risk.
- Interpret low, medium and high risk levels.
- Recognise common identity risk detections.
- Use risk-based policies and evidence to investigate suspected compromise.
The problem this solves
Passwords can be correct, MFA can succeed and Conditional Access can grant access while the underlying activity is still suspicious.
Identity Protection adds another layer of analysis by assessing whether the user account or sign-in behaviour appears risky.
What is Microsoft Entra ID Protection?
Microsoft Entra ID Protection evaluates identity signals and produces risk detections related to users and sign-ins.
These signals can be reviewed by analysts or used by Conditional Access to require stronger authentication, force secure password change or block access.
Risk detections should trigger investigation. They should not be treated as an automatic verdict without reviewing the surrounding evidence.
User risk
User risk represents the likelihood that an identity has been compromised.
It can remain elevated across multiple sign-ins until the risk is remediated, dismissed or otherwise resolved.
Sign-in risk
Sign-in risk represents the likelihood that a specific authentication attempt was not performed by the legitimate user.
It is tied to an individual sign-in event and can be used by Conditional Access during the access decision.
User risk compared with sign-in risk
| Risk type | Question answered | Typical scope | Common response |
|---|---|---|---|
| User risk | How likely is this identity compromised? | The user account over time. | Require secure password change, investigate the account or block access. |
| Sign-in risk | How risky is this specific authentication? | One sign-in event. | Require MFA, block the sign-in or investigate the event. |
Risk levels
Microsoft Entra commonly presents risk as low, medium or high.
The level reflects Microsoft’s confidence and severity assessment based on the detections associated with the activity.
Risk state
Risk state describes the current handling status of the risk, such as at risk, confirmed compromised, remediated or dismissed.
Analysts should distinguish the severity of the risk from the administrative state used to track its resolution.
Understanding risk levels
| Level | Meaning | Analyst approach |
|---|---|---|
| Low | Some suspicious characteristics are present, but confidence is limited. | Review context, especially if the user is privileged or the activity is unusual. |
| Medium | Multiple or stronger signals indicate potentially suspicious behaviour. | Prioritise investigation and consider additional authentication or containment. |
| High | Strong evidence suggests likely compromise or clearly malicious behaviour. | Investigate urgently and contain the identity if the evidence supports compromise. |
Real-time detections
Some risk detections can be evaluated during the sign-in process.
This allows Conditional Access to make an immediate access decision based on the risk calculated at authentication time.
Offline detections
Other detections are calculated after Microsoft analyses broader telemetry and patterns.
A sign-in may therefore be labelled risky after access was already granted, making post-sign-in monitoring important.
Common risk detections
| Detection | What it may indicate |
|---|---|
| Atypical travel | Sign-ins from geographically distant locations or travel patterns that differ from the user’s normal behaviour. |
| Anonymous IP address | Authentication through anonymising services such as Tor or certain proxy networks. |
| Malicious IP address | Sign-in activity from infrastructure associated with known malicious behaviour. |
| Unfamiliar sign-in properties | Changes in device, browser, location, IP address or other characteristics. |
| Password spray | Repeated attempts using common passwords across multiple accounts. |
| Leaked credentials | Credentials discovered in known breach or threat-intelligence datasets. |
| Token anomaly | Unexpected characteristics associated with token use, replay or session activity. |
Impossible travel and atypical travel
Travel-based detections compare sign-in locations and timing to determine whether movement appears plausible.
VPN use, mobile carrier routing and cloud infrastructure can create unusual location patterns, so the detection must be investigated in context.
Anonymous and malicious IPs
Anonymous infrastructure can hide the true origin of an attacker, while malicious IP intelligence may identify known hostile infrastructure.
Neither signal should be viewed alone; combine it with device, application, authentication and post-sign-in activity.
Risk-based Conditional Access
Secure password change
A user risk policy can require a secure password change when the user is considered compromised.
The process should be supported by strong authentication and appropriate account recovery controls.
Block access
High-risk sign-ins or users may be blocked when the organisation cannot safely remediate during the sign-in.
Blocking should be tested carefully to avoid excluding emergency or recovery accounts.
Identity investigation workflow
The risk alert tells you where to look. The surrounding telemetry tells you what actually happened.
Review the sign-in
Start with the sign-in status, application, IP address, location, device information, authentication steps and Conditional Access evaluation.
Determine whether the sign-in was interactive, non-interactive or related to an existing session.
Review identity changes
Attackers may change passwords, add authentication methods, grant application consent or modify account recovery details.
Entra audit logs help establish whether suspicious changes occurred before or after the risky sign-in.
Example investigation
Risk does not equal compromise
Legitimate travel, VPN changes, mobile networks, testing and automation can produce unusual signals.
Analysts should verify the activity before declaring an account compromised, while still acting quickly when the evidence is strong.
MFA does not erase risk
A risky sign-in may still complete MFA if the user is socially engineered or if an attacker reuses a stolen session.
Review how MFA was satisfied and what occurred after access was granted.
Remediation and containment
- Revoke active sessions and refresh tokens.
- Reset the password using a verified recovery process.
- Remove untrusted authentication methods.
- Review application consent and service principal permissions.
- Investigate mailbox rules and forwarding settings.
- Check endpoint telemetry for credential theft or token compromise.
- Mark the user or detection remediated only after the evidence is reviewed.
Common mistakes
| Mistake | Why it creates risk | Better practice |
|---|---|---|
| Ignoring low-risk detections | Repeated low-confidence signals may reveal a larger pattern. | Review context and prioritise privileged or sensitive users. |
| Assuming MFA removed the threat | Users can approve attacker prompts and sessions can be stolen. | Inspect authentication details and post-sign-in activity. |
| Using risk policies only in report-only mode | Risk is observed but no protection is enforced. | Pilot, validate and move appropriate policies into enforcement. |
| Closing risk without investigation | Dismissal may hide genuine compromise. | Document evidence and resolution before changing the risk state. |
| Reviewing only Entra logs | The attacker’s activity may continue in Exchange, endpoints or applications. | Correlate Entra with Defender XDR, audit and workload telemetry. |
Key takeaways
- User risk measures the likelihood that an identity is compromised.
- Sign-in risk measures the likelihood that a specific authentication is suspicious.
- Risk detections may be calculated in real time or after the sign-in.
- Conditional Access can respond to risk with MFA, password change or blocking.
- Risk is a starting point for investigation, not automatic proof of compromise.
- Strong investigations correlate Entra data with audit, endpoint, mailbox and application activity.
Related Agent Foskett resources
Continue learning
Microsoft Entra Risky Users and Risky Sign-ins
Microsoft Entra ID Protection identifies user risk, sign-in risk, identity risk detections, suspicious authentication activity and possible account compromise.
Microsoft Entra Academy Lesson 5 — Risky Users and Risky Sign-ins
This Agent Foskett Microsoft Entra Academy lesson explains risk levels, risk states, identity detections, risk-based Conditional Access and identity investigation workflows.
