Risky Sign-Ins Report

Sign-in events flagged as risky by Microsoft Entra ID Protection. Monitor suspicious authentication attempts, investigate potential account compromise, and take remediation actions.

Overview

The Risky Sign-Ins Report displays all sign-in events that Entra ID Protection has identified as potentially compromised. Risk is assessed based on factors such as impossible travel, unfamiliar locations, malware-linked IP addresses, and anomalous sign-in properties.

Report Columns

Column	Description
Date/Time	When the risky sign-in occurred
User	User principal name and display name
IP Address	Source IP address of the sign-in
Location	Geographic location based on IP
Risk Level	Low, Medium, or High
Risk State	At Risk, Confirmed Compromised, Dismissed, or Remediated
Risk Detail	Specific risk detection type
Application	Target application
Device	Device and browser information
MFA Satisfied	Whether MFA was completed

Risk Detection Types

Impossible travel — Sign-ins from distant locations in an impossible time frame
Unfamiliar sign-in properties — Sign-in from a new device, location, or network
Malware-linked IP — Sign-in from an IP associated with malware activity
Anonymous IP — Sign-in from a Tor or VPN anonymizer
Password spray — Multiple failed attempts consistent with spray attacks
Leaked credentials — User credentials found in known data breaches
Anomalous token — Unusual token characteristics detected

Risk Levels

High — Strong indicators of compromise; immediate investigation recommended
Medium — Suspicious activity detected; review and monitor
Low — Minor anomaly detected; may be benign

Remediation Actions

Require password change — Force the user to reset their password
Require MFA — Require re-authentication with MFA
Block sign-in — Temporarily block the user account
Confirm compromised — Mark the account as compromised for investigation
Dismiss — Mark as false positive after investigation

Filters

Date Range — Last 24 hours, 7 days, 30 days, or custom
Risk Level — High, Medium, Low
Risk State — At Risk, Confirmed, Dismissed, Remediated
Detection Type — Filter by specific risk detection
Tenant — Filter by managed tenant

Graph API Data Sources

GET /identityProtection/riskySignIns (deprecated)
GET /identityProtection/riskDetections

API Reference

GET /api/reports/security/risky-sign-ins — Get risky sign-ins report
POST /api/reports/security/risky-sign-ins/{id}/remediate — Take action on a risky sign-in
POST /api/reports/security/risky-sign-ins/export — Export report data