azure:riskdetection
Entra ID Protection risk detections
- Host type
- Azure (platform and Entra ID)
- Tier, as a whole
- Recommended
- Cost class
- Paid tier
- Techniques
- 0
- Rules listed
- 25
- Events
- 0
Why this tier
OMB M-26-14 A6 (Security tooling alerts; our analysis)
Licensing
- License or service
- Entra ID P2 / Entra Suite
- What is free
- Limited risky-user/sign-in views on Free/P1
- What costs
- Full risk detections report and Graph risk APIs need P2; risky sign-ins retention 90d P2
- As read on
- 2026-11-01
A vendor statement as read on the date shown; the cost class is the durable part.
Standards and guidance naming this source
| Requirement | Relation | Basis |
|---|---|---|
| OMB M-26-14: Security tooling alerts | Supports an activity | our analysis: identity risk detections |
Techniques
No ATT&CK analytic names this source.
Rules
Sigma 19
- Activity From Anonymous IP Address by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Anomalous Token by Mark Morowczynski '@markmorow'
- Anomalous User Activity by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Anonymous IP Address by Gloria Lee, '@gleeiamglo'
- Atypical Travel by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Azure AD Account Credential Leaked by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Azure AD Threat Intelligence by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Impossible Travel by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Malicious IP Address Sign-In Failure Rate by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Malicious IP Address Sign-In Suspicious by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- New Country by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Password Spray Activity by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Primary Refresh Token Access Attempt by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- SAML Token Issuer Anomaly by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Sign-In From Malware Infected IP by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Suspicious Browser Activity by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Suspicious Inbox Forwarding Identity Protection by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Suspicious Inbox Manipulation Rules by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
- Unfamiliar Sign-In Properties by Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
Events
No event-level rows: this source is tiered as a whole.