Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
Protection against phishing, malware, and other threats targeting email and collaboration tools in Microsoft 365
Risky User Dismissals Generating Defender Alerts
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(163.2, 92%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
Martin Shaw
0
Reputation points
Bit of a odd one we've just noticed as we put our Defender into a Third party SIEM.
When a user gets marked as a risky user (regardless of level - low, medium. etc.) when we dismiss the user risk in Entra it subsequently generates an 'Unfamiliar sign-in properties involving one user' alert in Defender for the user. This alert is automatically resolved as soon as it's generated.
Can anyone shed some light on why this happens? And if there is a way to disable these alerts or the link that generates them?
Microsoft Security | Microsoft Defender | Microsoft Defender for Office 365
Sign in to answer