Investigating risk using AAD Identity Protection

Risky users

With the information provided by the risky users report, administrators can find:

• Which users are at risk, have had risk remediated, or have had risk dismissed?
• Details about detections
• History of all risky sign-ins
• Risk history

Administrators can then choose to take action on these events. Administrators can choose to:

• Reset the user password
• Confirm user compromise
• Dismiss user risk
• Block user from signing in
• Investigate further using Azure ATP

Risky sign-ins

The risky sign-ins report contains filterable data for up to the past 30 days (one month).

With the information provided by the risky sign-ins report, administrators can find:

• Which sign-ins are classified as at risk, confirmed compromised, confirmed safe, dismissed, or remediated.
• Real-time and aggregate risk levels associated with sign-in attempts.
• Detection types triggered
• Conditional Access policies applied
• MFA details
• Device information
• Application information
• Location information

Administrators can then choose to take action on these events. Administrators can choose to:

• Confirm sign-in compromise
• Confirm sign-in safe