The 10 Most Common Microsoft Entra Sign-In Risk Detections Explained

Key Takeaway

Microsoft Entra Identity Protection continuously evaluates authentication activity to determine whether a sign-in attempt may represent a security risk. These detections help organizations identify compromised accounts, suspicious locations, malicious infrastructure, credential attacks, and abnormal authentication behavior before attackers gain deeper access to Microsoft 365 resources.

Understanding what these detections mean is just as important as seeing the alerts themselves. Organizations that know how to interpret sign-in risk signals can make better security decisions, implement more effective Conditional Access policies, and respond to identity threats more quickly.

A sign-in risk detection is not simply an alert. It is Microsoft telling you that something about the authentication attempt deserves closer scrutiny.

Understanding Microsoft Entra Sign-In Risk

Microsoft Entra Identity Protection analyzes authentication behavior across Microsoft’s global ecosystem to identify potentially suspicious activity. Sign-in risk focuses on a single authentication event and attempts to determine whether the login itself should be trusted.

Unlike user risk, which evaluates whether an account may be compromised overall, sign-in risk examines the specific context surrounding a login attempt. Microsoft evaluates location, IP reputation, authentication patterns, prior user behavior, threat intelligence, and numerous other signals when determining risk. If you are unfamiliar with the differences between these two identity protection signals, see our guide on Microsoft Entra User Risk and Sign-In Risk , which explains how Microsoft assesses account compromise indicators and authentication-based threats.

The objective is to provide organizations with more information than simply whether the user entered the correct password. The question becomes whether the sign-in itself appears legitimate.

How Microsoft Categorizes Sign-In Risk

Microsoft Entra sign-in risk detections generally fall into several categories. Some focus on geographic anomalies, others focus on infrastructure reputation, while additional detections focus on authentication attacks, session behavior, or threat intelligence correlations.

Understanding which category a detection belongs to helps organizations determine both the severity of the event and the most appropriate response strategy.

1. Impossible Travel

Impossible Travel identifies authentication activity that appears to occur from locations that would be physically difficult or impossible for the same user to travel between within the observed timeframe.

For example, a user may appear to sign in from Michigan and then authenticate from another country shortly afterward. Microsoft evaluates timing, distance, prior patterns, and additional contextual information when calculating the risk.

Although these alerts often indicate account compromise, they can also be caused by VPN usage, cloud proxies, mobile carrier routing, and legitimate travel activity.

Impossible Travel should initiate validation and investigation, not immediate assumptions.

2. Atypical Travel

Atypical Travel focuses on unusual authentication behavior that differs from the user’s normal sign-in patterns. Rather than identifying physically impossible movement, Microsoft evaluates whether the user’s recent activity appears inconsistent with historical behavior.

A sign-in may originate from a new location, device, browser, network, or usage pattern that Microsoft considers unusual for that individual user.

These detections often provide valuable early warning indicators that help organizations investigate potentially compromised accounts before more severe events occur.

3. Anonymous IP Address Activity

Anonymous IP detections identify authentication attempts originating from infrastructure commonly associated with hiding a user’s true location or identity. This may include anonymization services, proxy networks, and other technologies designed to obscure source attribution.

While anonymous networking technologies can have legitimate use cases, they are frequently leveraged by attackers attempting to conceal their activity.

These detections become especially significant when combined with unfamiliar locations, elevated privileges, failed sign-ins, or additional identity protection alerts.

4. Malicious IP Address Activity

Malicious IP detections identify sign-ins originating from infrastructure that Microsoft associates with suspicious or hostile activity. These assessments rely on Microsoft’s threat intelligence, reputation feeds, and global security telemetry.

Because attackers often reuse infrastructure across credential attacks, bot campaigns, and phishing operations, IP reputation can provide valuable evidence during investigations.

Security teams should evaluate authentication success, user privileges, device context, and post-authentication activity whenever a Malicious IP detection occurs.

Malicious IP detections become significantly more valuable when combined with user behavior, authentication outcomes, and related security events.

Why Context Matters During Investigation

One of the most common mistakes organizations make is treating every risk detection as either completely trustworthy or completely ignorable. Effective identity security requires context, investigation, and validation.

Device status, user role, application accessed, authentication method, travel patterns, and business purpose all influence how a security team should respond to a detection.

Additionally, organizations should evaluate both account compromise indicators and authentication-based detections together. Our article on Microsoft Entra User Risk and Sign-In Risk explains how these risk signals work together to support Conditional Access, Zero Trust, and identity protection strategies.

5. Password Spray Activity

Password spray attacks are among the most common authentication attacks targeting Microsoft 365 environments. Rather than attempting dozens of passwords against a single account, attackers attempt a small number of commonly used passwords across many accounts.

This approach helps attackers avoid traditional account lockout protections while maximizing their chances of finding users with weak or reused passwords. Even one successful authentication can provide access to email, files, Teams conversations, SharePoint sites, and other Microsoft 365 workloads.

Microsoft Entra identifies patterns associated with password spray attacks and generates risk detections that allow organizations to investigate and respond before widespread compromise occurs.

Password spray attacks succeed because attackers target people at scale rather than attempting to brute force individual accounts.

6. New Country Detection

New Country detections identify authentication activity originating from countries or regions that are unusual for a specific user. While geographic anomalies can indicate account compromise, they should always be evaluated within the broader context of user activity.

Business travel, VPN services, cloud-based proxies, and international operations can all generate legitimate detections. Security teams should validate the authentication event before assuming malicious intent.

New Country detections become especially meaningful when combined with other risk signals such as unfamiliar devices, anonymous IP addresses, failed authentication attempts, or privileged account access.

7. Token Anomalies

Modern identity attacks increasingly focus on authentication tokens rather than passwords. A valid session token may provide continued access to services even after authentication has already occurred.

Token anomaly detections help identify potentially suspicious behavior involving authentication tokens, session artifacts, refresh tokens, or abnormal authentication flows.

Because token-related attacks can bypass traditional credential protections, organizations should investigate these detections carefully and review active sessions, devices, and application access.

8. Unfamiliar Sign-In Properties

Unfamiliar Sign-In Properties detections occur when a user’s authentication behavior differs significantly from established historical patterns.

Microsoft evaluates browser characteristics, device information, operating systems, network locations, authentication methods, and usage patterns to identify behavior that appears unusual for a specific user.

These detections often serve as valuable early indicators that additional investigation may be necessary. While they do not automatically indicate compromise, they provide important context during identity investigations.

9. Leaked Credentials

Leaked Credentials detections identify accounts whose credentials may have been exposed through external compromise activity, password databases, credential theft campaigns, or other threat intelligence sources.

Among Microsoft’s various identity protection signals, leaked credentials represent one of the strongest indicators that attackers may possess valid authentication information.

Organizations should prioritize investigation and remediation whenever leaked credential detections occur.

10. Microsoft Threat Intelligence Detections

Microsoft continuously gathers threat intelligence from its global ecosystem and uses that information to identify authentication activity associated with known malicious infrastructure, active attacks, and emerging threat campaigns.

These detections provide visibility that often extends far beyond what a single organization can observe within its own environment.

By combining local authentication data with Microsoft’s global intelligence network, organizations gain valuable context that can help identify sophisticated threats and malicious activity earlier in the attack lifecycle.

Not All Risk Detections Carry the Same Weight

One of the most important lessons for Microsoft 365 administrators is understanding that every detection should not be treated identically. Some detections represent stronger indicators of compromise than others and may require more immediate response.

Context, user privileges, business impact, and related activity should always influence investigation and remediation decisions.

Recommended Investigation Process

Organizations should establish a repeatable process for investigating sign-in risk detections. Consistency improves security outcomes, reduces confusion, and supports audit and compliance requirements.

Closing Thoughts

Microsoft Entra Sign-In Risk detections provide valuable visibility into authentication activity that may otherwise go unnoticed. Understanding these detections helps organizations investigate more effectively, respond more consistently, and strengthen their Microsoft 365 security posture.

When combined with Conditional Access, governance processes, strong authentication controls, and effective incident response procedures, Microsoft Entra Identity Protection becomes a powerful component of a modern Zero Trust security strategy.