Reference

Risky Entra ID Sign-In

Shows Risky Entra ID Sign-Ins

Part of the Entra ID inventory.

Scan settings

Default scanning intervalAllowed scanning intervalsData removal during incremental scan
DailyDaily, Weekly, Bi-Weekly, Monthly, Never, InitialNo

Properties

Property Type Description Automation placeholder
Activity Date DateTime Date and time (UTC) the sign-in was initiated. Example: midnight on Jan 1, 2014 is reported as 2014-01-01T00:00:00Z. {{RiskyEntraIDSignIn.ActivityDateTime}}
Additional Details String Provides additional details on the sign-in activity. {{RiskyEntraIDSignIn.AdditionalDetails}}
Anonymized IP Address String Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN. {{RiskyEntraIDSignIn.AnonymizedIPAddress}}
App Display Name String App name displayed in the Azure Portal. {{RiskyEntraIDSignIn.AppDisplayName}}
App Id String Unique GUID representing the app ID in the Microsoft Entra ID. {{RiskyEntraIDSignIn.AppId}}
Browser String Indicates the browser information of the used for signing in. {{RiskyEntraIDSignIn.Browser}}
City String Provides the city where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity. {{RiskyEntraIDSignIn.City}}
Client App Used String Identifies the client used for the sign-in activity. Modern authentication clients include Browser and modern clients. Legacy authentication clients include Exchange ActiveSync, IMAP, MAPI, SMTP, POP, and other clients. {{RiskyEntraIDSignIn.ClientAppUsed}}
Conditional Access Status String Reports status of an activated conditional access policy. Possible values are: success, failure, notApplied, and unknownFutureValue. Allowed values: Failure, NotApplied, Success, UnknownFutureValue. {{RiskyEntraIDSignIn.ConditionalAccessStatus}}
Correlation Id String The request ID sent from the client when the sign-in is initiated; used to troubleshoot sign-in activity. {{RiskyEntraIDSignIn.CorrelationId}}
Country Or Region String Provides the country code info (2 letter code) where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity. {{RiskyEntraIDSignIn.CountryOrRegion}}
Initially Scanned DateTime Shows when this object was initially found in a scan. {{RiskyEntraIDSignIn.CreatedTime}}
Device Id String Refers to the UniqueID of the device used for signing in. {{RiskyEntraIDSignIn.DeviceId}}
Device is compliant Boolean Indicates whether the device is compliant. {{RiskyEntraIDSignIn.DeviceIsCompliant}}
Device is managed Boolean Indicates whether the device is managed. {{RiskyEntraIDSignIn.DeviceIsManaged}}
Display Name String {{RiskyEntraIDSignIn.DisplayName}}
Display Name Device String Refers to the name of the device used for signing in. {{RiskyEntraIDSignIn.DisplayNameDevide}}
Error Code String Provides the 5-6 digit error code that's generated during a sign-in failure. {{RiskyEntraIDSignIn.ErrorCode}}
Failure Reason String Provides the error message or the reason for failure for the corresponding sign-in activity. {{RiskyEntraIDSignIn.FailureReason}}
Generic String Indicates that the user was not enabled for Identity Protection. {{RiskyEntraIDSignIn.Generic}}
Investigations Threat Intelligence String Indicates a sign-in activity that is unusual for the given user or is consistent with known attack patterns based on Microsoft's internal and external threat intelligence sources. {{RiskyEntraIDSignIn.InvestigationsThreatIntelligence}}
Ip Address String IP address of the client used to sign in. {{RiskyEntraIDSignIn.IpAddress}}
Is Interactive String Indicates if a sign-in is interactive or not. {{RiskyEntraIDSignIn.IsInteractive}}
Last scan update DateTime Shows when this object was last updated in a scan. If an object is found during a scan but no property has been changed this date will not change. {{RiskyEntraIDSignIn.LastModifiedTime}}
Latitude Double The latitude, in decimal, for the item. {{RiskyEntraIDSignIn.Latitude}}
Leaked Credentials String Indicates that the user's valid credentials have been leaked. This sharing is typically done by posting publicly on the dark web, paste sites, or by trading and selling the credentials on the black market. When the Microsoft leaked credentials service acquires user credentials from the dark web, paste sites, or other sources, they are checked against Entra ID users' current valid credentials to find valid matches. {{RiskyEntraIDSignIn.LeakedCredentials}}
Longitude Double The longitude, in decimal, for the item. {{RiskyEntraIDSignIn.Longitude}}
Malicious IP Address String Indicates sign-ins from a malicious IP address. An IP address is considered malicious based on high failure rates because of invalid credentials received from the IP address or other IP reputation sources. {{RiskyEntraIDSignIn.MaliciousIPAddress}}
Malware Infected IP Address String Indicates sign-ins from IP addresses infected with malware. Deprecated and no longer generated for new detections. {{RiskyEntraIDSignIn.MalwareInfectedIPAddress}}
Operating System String Indicates the operating system name and version used for signing in. {{RiskyEntraIDSignIn.OperatingSystem}}
Risk Detail String Provides the 'reason' behind a specific state of a risky user, sign-in or a risk event. The possible values are: none, adminGeneratedTemporaryPassword, userPerformedSecuredPasswordChange, userPerformedSecuredPasswordReset, adminConfirmedSigninSafe, aiConfirmedSigninSafe, userPassedMFADrivenByRiskBasedPolicy, adminDismissedAllRiskForUser, adminConfirmedSigninCompromised, unknownFutureValue. The value none means that no action has been performed on the user or sign-in so far. Allowed values: AdminConfirmedSigninCompromised, AdminConfirmedSigninSafe, AdminDismissedAllRiskForUser, AdminGeneratedTemporaryPassword, AiConfirmedSigninSafe, None, UnknownFutureValue, UserPassedMFADrivenByRiskBasedPolicy, UserPerformedSecuredPasswordChange, UserPerformedSecuredPasswordReset. {{RiskyEntraIDSignIn.RiskDetail}}
Risk Level Aggregated String Aggregated risk level. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in was not enabled for Entra ID Identity Protection. Allowed values: Hidden, High, Low, Medium, None, UnknownFutureValue. {{RiskyEntraIDSignIn.RiskLevelAggregated}}
Risk Level During SignIn String Risk level during sign-in. The possible values are: none, low, medium, high, hidden, and unknownFutureValue. The value hidden means the user or sign-in was not enabled for Entra ID Identity Protection. Allowed values: Hidden, High, Low, Medium, None, UnknownFutureValue. {{RiskyEntraIDSignIn.RiskLevelDuringSignIn}}
Risk Score Int32 Stores risk score {{RiskyEntraIDSignIn.RiskScore}}
Risk Score Update DateTime Stores risk score update {{RiskyEntraIDSignIn.RiskScoreLastUpdate}}
Risk Score Value String Stores risk score value like Low_Low {{RiskyEntraIDSignIn.RiskScoreValue}}
Risk State String Reports status of the risky user, sign-in, or a risk event. The possible values are: none, confirmedSafe, remediated, dismissed, atRisk, confirmedCompromised, unknownFutureValue. Allowed values: atRisk, confirmedCompromised, confirmedSafe, dismissed, none, remediated, unknownFutureValue. {{RiskyEntraIDSignIn.RiskState}}
Id String Unique ID representing the sign-in activity. {{RiskyEntraIDSignIn.SignInActivityId}}
State String Provides the State where the sign-in originated. This is calculated using latitude/longitude information from the sign-in activity. {{RiskyEntraIDSignIn.State}}
Suspicious IP Address String Identifies logins from IP addresses that are known to be malicious at the time of the sign in. {{RiskyEntraIDSignIn.SuspiciousIPAddress}}
Unfamiliar Features String Indicates sign-ins with characteristics that deviate from past sign-in properties. {{RiskyEntraIDSignIn.UnfamiliarFeatures}}
Unknown Future Value String Evolvable enumeration sentinel value. Do not use. {{RiskyEntraIDSignIn.UnknownFutureValue}}
Unlikely Travel String Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior. {{RiskyEntraIDSignIn.UnlikelyTravel}}
User User Sign-Ins of the user {{RiskyEntraIDSignIn.User}}
User Id String ID of the user that initiated the sign-in. {{RiskyEntraIDSignIn.UserId}}
User Name String Sign-Ins of the user {{RiskyEntraIDSignIn.UserName}}
UserPrincipalName String User principal name of the user that initiated the sign-in. {{RiskyEntraIDSignIn.UserPrincipalName}}

Relations

Relation Service Description
User Microsoft 365 All users registered in your tenant (internal, external)

Segments

Segment Description
Conditional access Sign-Ins Shows Sign-Ins using conditional access
Failed sign-ins Shows unsuccesfull sign-ins
Risky Sign-Ins Shows Sign-Ins with Risk State "At Risk"

Actions

This object does currently not have any actions.

Policy Severity Description
Risky Sign-Ins High Shows Sign-Ins with risk state "At Risk"

Last updated: 7/19/2026