System is automatically remediating risky sign-ins

Question

System is automatically remediating risky sign-ins

Lindaman, Lucas 0

The system appears to be marking all Entra ID risky sign-in events as "Remediated" without admin intervention. Why is this happening?

1 answer

Your answer

Answer 1

Andy David - MVP 157.8K MVP Volunteer Moderator

Sure the users didnt remediate themselves?

https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-remediate-unblock#self-remediation-with-risk-based-policy

Bandela Siri Chandana 3,055 Reputation points Microsoft External Staff Moderator

2024-12-12T13:51:48.3333333+00:00

Hi @Lindaman, Lucas

Thank you for posting your query on Microsoft Q&A.

I understand that system appears to be marking all Entra ID risky sign-in events as "Remediated" without admin intervention.

Users can self-remediate their risk by implementing risk-based policies. In your circumstance, users may have passed the needed access control, such as multifactor authentication, in which the user has registered and passed MFA, or secure password reset, resulting in their risks being automatically mitigated.

This is predicted behavior that occurred without the assistance of admin.

Hope this helps. Do let us know if you have any further queries.

Thanks,

B. Siri Chandana.
Lindaman, Lucas 0 Reputation points

2024-12-12T15:09:26.5233333+00:00

Thank you for your response.

This seems to have just started 2 months ago. We do not have any conditional access/access control policies that would be automatically marking the risky sign-ins as remediated. I do not see the “AI confirmed sign-in safe” risk detail that is supposed to appear if the system automatically remediates the sign-in.

Is there any section where I can audit the risk remediation/detail history?
Bandela Siri Chandana 3,055 Reputation points Microsoft External Staff Moderator

2024-12-13T10:53:35.0566667+00:00

Hi @Lindaman, Lucas
I understand that you don't have any conditional access/access control policies and any risk detail that would result to automatic remediation.

Follow the below document to audit the risk remediation or detail history:

https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk
Thanks,

B. Siri Chandana.
Bandela Siri Chandana 3,055 Reputation points Microsoft External Staff Moderator

2024-12-16T12:32:46.6733333+00:00

Hi @Lindaman, Lucas
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.
Bandela Siri Chandana 3,055 Reputation points Microsoft External Staff Moderator

2024-12-17T09:47:28.29+00:00

Hi @Lindaman, Lucas
Just checking in to see if above information was helpful. If you have any further updates on this issue, please feel free to post back.

Share via

System is automatically remediating risky sign-ins

1 answer

Your answer