Sign In Threat Detected
Detects successful user sign-ins associated with a Microsoft Entra ID Risk User event, which may indicate unauthorized access.
The allowlist may be configured under Check Settings to focus on specific severity levels, enabling you to reduce the associated noise.
Recommended Actions
Please investigate this suspicious sign-in to confirm the account is not compromised. If the user is compromised, consider killing all sessions and add the user to a quarantine group.
Compatibility
Last updated