What happens when Microsoft Entra ID Protection’s threat intelligence or advanced machine-learning algorithms indicate that a user compromised their credentials?

When a risk event is created, which risk level identifies events that are potentially risky, and any affected user accounts should be remediated?