Sign In Threat Detected

Detects successful user sign-ins associated with a Microsoft Entra ID Risk User event, which may indicate unauthorized access.

The allowlist may be configured under Check Settings to focus on specific severity levels, enabling you to reduce the associated noise.

Recommended Actions

Please investigate this suspicious sign-in to confirm the account is not compromised. If the user is compromised, consider killing all sessions and add the user to a quarantine group.


Microsoft Entra ID

Last updated