Risky sign-ins

Last updated Oct 17, 2026 Policies Access & Sharing

AI summary

A Rencore policy flags risky sign-ins detected by Microsoft Entra ID Protection, including those from anonymous networks, unfamiliar locations, or with leaked credentials. Investigate each occurrence and either reset the password and revoke sessions if the account is compromised, or dismiss if the user confirms it was legitimate.

Severity: High Security Generally available

What it detects

Shows Sign-Ins with risk state "At Risk".

Why it matters

Microsoft Entra ID Protection marks a sign-in as at risk when it may not have come from the account's owner, for example from an anonymous IP address, an unfamiliar location or with leaked credentials. Until someone looks at it, an attacker may be using the account. Investigate each sign-in: if the account is compromised, reset the password and revoke its sessions. If the user confirms it was them, dismiss the risk.

The rule

Every Risky Entra ID Sign-In where Risk State equals 'atRisk'

In Rencore Governance

Details

Applies to	Risky Entra ID sign-in
Connector	Entra ID
Severity	High
Category	Security
Recommended	No
Recommended automation	None
License type	Standard

Frequently asked questions

What does the risky sign-ins policy detect?

The Risky sign-ins policy shows Sign-Ins with risk state "At Risk".

Which objects does the risky sign-ins policy check?

The Risky sign-ins policy checks Risky Entra ID sign-in objects from the Entra ID inventory and reports each one that matches its rule as a violation.

How severe is a violation of the risky sign-ins policy?

Violations of the Risky sign-ins policy have High severity. The policy is in the Security category.

Which module includes the risky sign-ins policy?

The Risky sign-ins policy comes with the Entra ID connector in the Digital Workplace module of Rencore Governance, which every Plan includes.

Was this page helpful?