Automated Reporting for Risky Users and Sign-ins in Entra ID P2

Question

We've recently signed up for the trial of Microsoft Entra ID P2 and are exploring its capabilities around identity protection and risk-based reporting. I'm looking for some guidance on how to set up automated reporting—specifically for detecting and alerting on risky users and risky sign-in activities. Ideally, I'd like to configure this so that an email is automatically sent to a designated address whenever such risky activities are detected within Entra. Could you advise if this is possible natively within Entra, or if it requires additional configuration through tools? Any documentation or tips you can share would be greatly appreciated.

Answer 1

Hello @Magda Wallace ,

I Understand that you signed up for the trial of Microsoft Entra ID P2 and are exploring its capabilities around identity protection and risk-based reporting.

You can set up automated reporting for risky users and risky sign-ins in Microsoft Entra ID P2 through the built-in notification features. Specifically, you can configure two types of automated emails:

1. Users at risk detected email: This email can be triggered when a user risk level that you set (default is "High") is detected. You can configure the recipients of this email in the Microsoft Entra admin center under Protection > Identity Protection > Users at risk detected alerts
   
2. Weekly digest email: This email provides a summary of new risk detections, including new risky users and risky sign-ins. You can enable or disable this feature and select the users who will receive it in the Microsoft Entra admin center under Protection > Identity Protection > Weekly digest.
   

Both of the above features allow you to automate the reporting of risky activities without requiring additional tools.

For additional Information you can follow the document: https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-notifications

Hope the Information Helps. Let us know if you have any additional queries. Happy to assist you further.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.