Entra ID Protection Identity Risk [CHK-3034]

Identity Protection classifies risk in named types — leaked credentials, password spray, sign-in from a nation-state linked IP address, adversary-in-the-middle session, attempted Primary Refresh Token access, authenticator phishing, token issuer anomaly, and an admin confirming an account as compromised, among others. The specific type is named in the ticket, because the response differs considerably between them.

Rationale

Identity is where most attacks against Microsoft 365 begin and end. An attacker who controls a valid account does not need malware, does not trip endpoint detection, and looks like a normal user in almost every log. Identity Protection is Microsoft's own signal that an account is not behaving like its owner.

Follow-up

Follow these steps to adequately address this detection:

1. Read the risk type named in the ticket. The response depends heavily on which detection fired. Leaked credentials calls for a password reset; an adversary-in-the-middle session calls for revoking tokens, because the password was never the weakness.
2. Establish whether the account owner recognises the activity. Contact them directly, not through the account in question. Ask about the time and location in the ticket, and whether they were prompted to approve anything unexpected.
   • If the risk is real: Treat the account as compromised. For any token-based risk type, a password reset alone is not sufficient:
     1. Revoke all active sessions via Entra admin center → Users → [user] → Revoke sessions. This invalidates issued refresh tokens.
     2. Reset the password via an out-of-band method, not by email to the affected account.
     3. Review MFA methods on the account and remove any the user does not recognise. Adding an authenticator is a common persistence step.
     4. Check for persistence: new device registrations, OAuth consent grants, inbox rules, and application credentials.
     5. Review activity since the detection in the Entra ID sign-in logs and the unified audit log, focusing on mailbox access, file downloads and admin portal use.
     6. Escalate to IR for privileged accounts or where the attacker had time to act. Contact Attic for incident response support.
   • If the risk is explainable: Some detections have legitimate causes — a VPN or travel explaining an unfamiliar location, or a password found in an old breach dump that has since been changed:
     1. Confirm the credential is genuinely no longer valid before dismissing a leaked-credentials detection.
     2. Dismiss the risk in Entra admin center → Protection → Identity Protection → Risky users, so the account does not remain flagged.
     3. Record the reason, so a repeat detection can be judged against it.
3. Review your Identity Protection policies. Detection is worth more when it is paired with automatic response. Risk-based Conditional Access can require a password change on high user risk or block sign-in on high sign-in risk, which acts in the moment rather than waiting for a ticket to be read.

More information

• Microsoft Learn: What is Identity Protection?
• Microsoft Learn: Risk detections reference
• Microsoft Learn: Investigate risk
• Microsoft Learn: Configure risk-based Conditional Access policies
• MITRE ATT&CK: T1078 - Valid Accounts
• MITRE ATT&CK: T1110.003 - Password Spraying