About sign-in and risky user report notification

ネパリ サンデャ 380 Reputation points
2023-12-13T08:02:10.9433333+00:00

I am supposed to have the risky user and sign-in risk report as the user alert is enable by default

But even though having High risk sign-in I didnot get any notification at all

There are more than 10 GA and confirm that there was not any notification sent to their emails also

Is the process I am performing correct?
Or am I missing something?

Microsoft Identity Manager
Microsoft Identity Manager
A family of Microsoft products that manage a user's digital identity using identity synchronization, certificate management, and user provisioning.
649 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marilee Turscak-MSFT 36,151 Reputation points Microsoft Employee
    2023-12-14T21:45:00.42+00:00

    Hi @ネパリ サンデャ ,

    The user needs to have an elevated role while the report is generated to get the email.

    You can verify this in tenant audit logs:

    Azure Active Directory Identity Protection notifications - Microsoft Entra | Microsoft Learn

    If you have self-remediation enabled for the tenant, it is also possible that the user already remediated the risk. You can see risky users and risky sign-ins that have been remediated by adding "Remediated" to the Risk state filter in either the Risky users or Risky sign-ins reports. https://video2.skills-academy.com/en-us/entra/id-protection/howto-identity-protection-configure-notifications#configure-users-at-risk-detected-alerts

    In addition, all users need to have a Premium P2 license. There isn't anything built in just for risky sign-ins alone, but you can set up either alerts based on user risk levels or alerts that come in a weekly digest email (which include risky sign-ins). To configure alerts based on user risk levels, you can go to Azure Active Directory > Security > Identity Protection > Users at risk detected alerts. These will be triggered based on the risk level, which is set to "high" by default.

    User's image

    You can also set up weekly digest emails. These emails include the following:

    New risky users detected
    New risky sign-ins detected (in real time)
    Links to the related reports in Identity Protection

    You can do this under Microsoft Entra ID > Security > Identity Protection > Weekly digest.

    https://video2.skills-academy.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications

    There is also this sample powershell script you can run for identifying risky users and eliminating false positives: https://github.com/AzureAD/IdentityProtectionTools

    Let me know if these suggestions help and if you still encounter any issues.

    If the information helped you, please Accept the answer. This will help us as well as others in the community who may be researching similar questions. Otherwise let us know if you have further questions.

    0 comments
  2. ネパリ サンデャ 380 Reputation points
    2023-12-15T00:28:46.73+00:00

    @Marilee Turscak-MSFT

    Thank you for the answer

    But I am sorry the answer didnot meet my question

    As , I have already read the doc multiple time and not found the answer what I am searching for

    My question was can we get notification for both risky users and risky sign-in using users at risk detected alert??

    I know I can get both using weekly digest but weekly digest generates report once a week as a summary but I have to have daily notification alert for both risky users and sign-ins

    I am asking this because even though I have risky sign--ins at high risk level I didnot get any notification at all

    0 comments