Kurt Shintaku's Blog

Did you know? Azure AD Identity Protection has risk detections for both premium licensed users and non-premium licensed users?

Azure AD Identity Protection identifies and reports suspicious actions related to user accounts in the directory, which contribute to the overall user risk score in the Risky Users report. The feature enables organizations to quickly see and respond to these suspicious actions.

The detection of risk can be classified into two levels, User and Sign-in, and can be calculated in Real-time or Offline mode. While certain risk types are exclusive to Azure AD Premium P2 customers, others are accessible to Free and Azure AD Premium P1 customers.

Sign-in risk refers to the likelihood that an authentication request is unauthorized by the identity owner. Suspicious activity may be identified for a user that is not associated with a specific malicious sign-in, but rather the user as a whole.

You can review which risk detections are for the Free, Azure AD Premium P1 and Azure AD Premium P2 licensed users here:

• What is risk? Azure AD Identity Protection
  https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#sign-in-risk