Malware-linked IP address – for instance, if the IP address where the sign-in originates is known to have been in contact with an active bot server.Token Issuer anomaly - detection that points out issues with the SAML token issuer or the claims in the token.Can be a noisy detection but can be useful for verification of anomalous activity Anomalous token - detection based on variations from the expected type of session or refresh token lifetime or usage.Atypical travel – for example, when two or more sign-ins occur from distant locations in an unrealistically short time period.User risks - the rating of whether a user's identity/account has been compromisedĪs part of sign-in risks, Microsoft provides the following detection types (documentation could be found here (List of Identity Protection risks)):.Sign-in risks - Identity Protection scrutinizes each authentication request to estimate the probability that a given request hasn't been performed by the expected identity owner.Therefore, they sit within these two broad categories: There's the concept of risks: suspicious activity and actions by users when they sign in, or when they take actions after signing in. in an attempt to learn about user behaviours and help automate the detection of anomalous behaviour that wouldn't be easily noticeable by a human user looking at logs.īased on documentation it uses predictive models based on analytics from Microsoft's own services such as Xbox and Microsoft account sign-ins to try to model the types of activities a regular user would perform.Īzure AD Premium P2 license is required for full access to this feature.

Service that uses Machine Learning and behavioural analysis, looking at users' login patterns, how they do it, location, MFA, etc.

Risky sign in azure ad