Risk Policies

Configure automated responses to user risk and sign-in risk detected by Microsoft Entra ID Protection.

User Risk Policy

Responds to the cumulative risk level of a user account:

Sign-in Risk Policy

Responds to the risk level of individual sign-in attempts:

Risk Detection Types

• Leaked credentials — Credentials found in breach databases
• Anonymous IP — Sign-in from anonymous proxy
• Atypical travel — Impossible travel between locations
• Malware-linked IP — Sign-in from known malware IP
• Unfamiliar sign-in — Unusual sign-in properties

API Reference

• GET /api/security/risk-policies — Get risk policies
• PUT /api/security/risk-policies — Update risk policies