Entra ID (Azure AD) Risk Events

Location

Description

Machine-learning-generated risk detections including anonymous IP usage, impossible travel, malware-linked IPs, password spray detection, leaked credential matches, token anomalies, and suspicious inbox manipulation rules.

Forensic Value

Risk events provide Microsoft threat intelligence context that is not available in raw sign-in logs. A "leaked credentials" detection confirms the user password was found in a breach database. "Anomalous token" detections flag token theft and replay scenarios. Correlating risk event timestamps with sign-in log entries creates a high-confidence timeline of exactly when the identity was compromised and from which infrastructure.

Tools Required