AD Risky Sign-Ins

Question

AD Risky Sign-Ins

Handian Sudianto 6,106

In the AD Risky Signin what is mean of Failure, Success and Interrupted on Status columns?

User's image

1 answer

Your answer

Answer 1

Marcin Policht 51,450 MVP Volunteer Moderator

Failure

Definition: This status indicates that the sign-in attempt was unsuccessful.
Possible reasons for failure:
Incorrect credentials (e.g., wrong username or password).
Multi-factor authentication (MFA) challenges that were not completed or failed.
Account locked or disabled.
- Other authentication errors (e.g., authentication failure due to expired tokens or certificates).
- Indicates: The user could not successfully authenticate, and the system did not allow access.

Success

Definition: This status indicates that the sign-in attempt was successful.
Possible reasons for success:
- The user provided correct credentials and passed any additional authentication checks (e.g., MFA).
  - No security policy or risk-based conditional access rule blocked the sign-in.
  - Indicates: The user was successfully authenticated and granted access to the resource or application.

Interrupted

Definition: This status indicates that the sign-in attempt was interrupted before a definitive success or failure could be determined.
Possible reasons for interruption:
- The sign-in process was halted due to conditional access policies that require MFA or other checks that couldn't be completed (e.g., MFA prompt not answered in time).
- The user might have canceled the sign-in or closed the browser window during the authentication process.
- Issues like network interruptions, timeouts, or connectivity problems could also cause the process to be interrupted.
Indicates: The authentication process started, but it did not finish properly due to external factors or a user action.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Handian Sudianto 6,106 Reputation points

2024-11-13T03:52:34.4733333+00:00

Hi

If you see on my picture above, there are some risky with status 'success' but on unknown location. So i must worried about this since this user can access to internal resources? Is different between success and compromise account?
Marcin Policht 51,450 Reputation points MVP Volunteer Moderator

2024-11-13T06:00:24.7666667+00:00

With successful sign-in, the "success" status indicates that the authentication attempt was successfully completed. This could happen from a legitimate user, even if the location is unfamiliar or not previously seen. However, "unknown location" typically refers to an IP address or geographic region that isn't recognized as part of the user's typical activity or previous sign-ins.

The term compromised account refers to an account that has been hijacked or taken over by a malicious actor, who may be attempting to access resources that the original user would typically access. The system flags an account as compromised if it detects anomalous behavior, such as risky sign-ins, unusual locations, changes in sign-in patterns, or other signs of suspicious activity.

A sign-in from an unknown location is flagged as risky because it could be an indication of an account being accessed from an unfamiliar or untrusted location, which might be indicative of suspicious or malicious activity.

This doesn't necessarily mean the account is compromised, but it is an indicator that additional scrutiny is needed. The user might be traveling, using a VPN, or accessing from a location they don't typically use, but it could also indicate an attacker using the account in an unusual manner.

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin
Goutam Pratti 6,170 Reputation points Microsoft External Staff Moderator

2024-11-14T08:18:30.9266667+00:00

Hello Handian Sudianto,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Goutam Pratti 6,170 Reputation points Microsoft External Staff Moderator

2024-11-15T08:14:06.5066667+00:00

Hello Handian Sudianto,

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Share via

AD Risky Sign-Ins

1 answer

Your answer