Azure: Sign-in was blocked due to real-time detection rule(s): TI_RT_0015

Question

Hi,

We have recently reset the passwords and advised Microsoft of some compromised accounts which were flagged to us in the 'Risky Users' section of Microsoft Azure. Subsequently, some of these users have then had further malicious login attempts which have failed, even if the password was entered correctly, and the given reason under the 'Authentication Details ---> Result Detail' section is "Sign-in was blocked due to real-time detection rule(s): TI_RT_0015".

What does this rule mean and when it is activated? Is it connected to the fact that we have flagged the user account as being compromised in the Risky User section?

Many thanks.

Shaun

Answer 1

Hi @PARR Shaun ,

Thanks for reaching out.

The TI_RT_0015 detection targets a password spray attack identified by Microsoft's threat intelligence and blocks sign-ins attributed to that attack.

There might be reason as the user account as being compromised in the Risky User section, Micrsoft' threat intelligence detected this as the risk. This risk detection type considers past sign-in history to look for anomalous sign-ins. The system stores information about previous sign-ins, and triggers risk detection when a sign-in occurs with properties that are unfamiliar to the user.

I am checking on this with the product team to confirm you further.

Thanks,

Shweta