Azure AD Identity protection "Suspicious Browser Type" alert generation

Question

Azure AD Identity protection "Suspicious Browser Type" alert generation

James Talley 1

I have been conducting research on various alert generation tactics used by Microsoft 365. I have been unsuccessful in finding any official documentation on the process in which The alerts data is gathered, or on how the alert is actually generated. I am trying to uncover any documentation that can help explain the process in which the information for "suspicious browser type" is gathered, and the process that creates and notifies the alert for "suspicious browser type".

3 answers

Your answer

Answer 1

Marilee Turscak-MSFT 37,206 Microsoft Employee Moderator

Hi @James Talley ,

Thanks for your post!

As documented in the Identity Protection guide, suspicious browser detection indicates anomalous behavior based on suspicious sign-in activity across multiple tenants from different countries in the same browser.

This is a relatively new detection that was released about a year ago.

What is the "Suspicious Browser" risk detection?

This is a premium offline sign-in risk detection
This detection flags sign-ins from browsers that are showing anomalous behavior, including sign-ins from multiple users and tenants, and from different IP addresses.
Like other sign-in risk detection, this too will contribute to user risk, which will be remediable through Conditional Access grant control "password change" remediation.

Let me know if this helps. If you are looking for more details around this, please let me know the specific data you are looking for and I will help provide that.

-

If the information provided was helpful to you, please remember to "mark as answer" so that others in the community with similar questions can more easily find a solution.

James Talley 1 Reputation point

2022-07-19T02:53:12.477+00:00

Hi @Marilee Turscak-MSFT

I appreciate your response! I am still trying to find out the specifics about this alert though. How does Microsoft gather the data used to generate the alert? Where is the data stored (locally on the users system, or in Microsoft's cloud storage)? How does this alert become generated? I would really appreciate any form of a "How it works" documentation.
I really need more than the generic round-about I keep finding. I want to understand and have an in-depth analysis of the alert to revert back to.
Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-07-19T15:33:54.077+00:00

Thanks! Those specific questions are helpful. I've reached out to the product team to check.
Marilee Turscak-MSFT 37,206 Reputation points Microsoft Employee Moderator

2022-07-21T17:51:18+00:00

I heard back from the product team that the information in our documentation is all we are legally allowed to provide around this topic. Due to our security requirements we cannot provide more details around how the backend works beyond what we have in our guides. The sign-in risks like the suspicious browser detection flag when authentication requests may not be authorized by the identity owner.

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection
https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications
Yashraj Salunkhepatil 1 Reputation point

2022-09-16T11:19:28.09+00:00

That just a summary of the alert. Please provide more details like does it check the IP address reputation ? Sites visited ? uploads / downloads ? What parameters are taken into consideration for the alert to be generated

Answer 2

MZ 1

This is a premium online sign in detection.
Makes learning and teaching more meaningful and understandable.
We are legally allowed to share the information related to the topic.
I have been conducting research on various topics and found this browse quite helpful.

Answer 3

MZ 1

This is a premium online sign in detection.
Makes learning and teaching more meaningful and understandable.
We are legally allowed to share the information related to the topic.
I have been conducting research on various topics and found this browse quite helpful.

Share via

Azure AD Identity protection "Suspicious Browser Type" alert generation

3 answers

Your answer