The signed in user is not assigned to a role for the signed in application. Assign the user to the application.

Question

I'm clear with the meaning of above decription. Just wonder in this case, if the the user's password authentication succeeded or not, so I can judge, as a security professional, if the user's account was compromised and take actions correspondingly.

The same case for Sign-in was blocked due to real-time detection rule(s): ***

I only know the access was blocked, not know if the pass auth was successful already.

Thank you.

Answer 1

Hi @Yao Lu ,

Thanks for your post! Identity protection only comes into play when primary Credentials are successful. Smart lockout is the closest solution to prevent first-factor/primary credentials and detect risk at that level. Using smart lockout, if primary credentials are successful, we detect a risk, and there is a policy to change the password, we will request that to happen or block the user.

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

Let me know if this helps and if you have further questions.

If the information addressed your question, please Accept the answer. This will help us as well as others in the community who may be researching similar information.