Note in particular the options along the top, I wouldn’t want you to miss something because your Auto refresh was set to Off or you were only viewing Remediated risks. In my example, I can see a couple of users which were detected at high risk. Microsoft also provide some guidance on simulation for for Identity Protection – Risky users NOTE: For completeness and if you want to test this yourself, I set my example policies to capture low risk and above events and then used Tor browser on an unmanaged VM to simulate some risky sign-in attempts. These are what have been detected as risky on our so-called scale of dodginess. To use another colloquial term, risk detections as you might expect is the actual meat and potatoes of this feature. I think these again are fairly self explanatory and you can see immediately how risky users and risky sign-ins will relate to the policies we just set. Realistically no-one is going to be able to keep track of all their users authentication requests so we rely on something computational to deal with the business as usual and then just tell us when something doesn’t meet the criteria we set in the aforementioned policies. Now, one of the keystones of AAD Identity Protection is automation. In this part we will look at some of the results of those policies with the Reports section of Microsoft Azure AD Identity Protection. In part 1 we covered the policies, how to define them and what they mean.

Looks at the reporting sections and what information Identity Protection can give us.Ĭovers the notification capability and how else we can use Identity Protection. What Identity Protection is, what you need and what the policies are.

This is the second of a three part blog which covers a walk through of Microsoft Azure Active Directory Identity Protection.

Risky sign in azure ad