AZ 500: Configure risk event detections

Question

Hi
I have a question about the risk levels referring to Microsoft Learn (AZ-500 part-1: Manage Identity and Access / Deploy Azure AD identity protection / Configure risk event detections).

What are the official recommendations for the following risks;
Users with leaked credentials -> High
Sign-ins from anonymous IP addresses -> Medium
Impossible travel to atypical locations -> Medium
Sign-ins from infected devices -> Low / Medium ?
Sign-in from unfamiliar locations -> Medium
Sign-ins from IP addresses with suspicious activity -> Medium / Low ?

Especially on the points: "Sign-ins from infected devices" and "Sign-ins from IP addresses with suspicious activity", I have seen disagreement in forums as well.
What are the official level recommendations from Microsoft?

Thanks for your effort in advance.

Kind regards

beni

Answer 1

Well, thats the thing, they are calculated by Microsoft either in real time or offline and then you have CA policies that block based on that risk level. If you choose to block high risk, sign-ins require MFA for medium etc... . So there isnt a standard list of this will be high , this will be medium...

Answer 2

Not sure what the question is. Microsoft assigns the risk, you don't.

Answer 3

Hi @Peter Benjamin • Thank you for reaching out.

I had the same question couple of months back as the books still have this information but this information is removed from the official documentation and Azure Portal.

Here is the official Microsoft statement regarding the risk levels for various risk detections:

Microsoft doesn't provide specific details about how risk is calculated, we'll say that each level brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user.

This is documented here: Risk levels

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.