Microsoft Entra ID ProtectionRisky User Report
In brief
To see risk sign-in events together with risky user events, select the **Aggregate risk signals by risky sign-ins** checkbox.
Documentation change
To see risk sign-in events together with risky user events, select the Aggregate risk signals by risky sign-ins checkbox.
Unified risk signals (Preview)
Unified risk signals
Microsoft Entra ID Protection now correlates signals from Microsoft Defender and other sources to provide unified risk signals for user risk detections. This preview feature enhances your risk detection capabilities by calculating a comprehensive Identity Risk Score based on multiple identity signals. This option must be enabled in settings.
Microsoft Entra ID Protection correlates signals from Microsoft Defender and other sources to provide unified risk signals for user risk detections. This capability calculates a comprehensive Identity Risk Score based on multiple identity signals from across your identity fabric, including linked accounts and account sets.
You can view unified risk signals in both the standard view and agent view of the Risky user report. Select a user from the list to see details for each linked account associated with a risky user, helping you understand the full scope of risk across a user's identity, including linked accounts. When the Identity Risk Score is raised, the Microsoft Entra score is also raised using the unified risk signals, which can automatically trigger your risk-based Conditional Access policies.
You can view unified risk signals in both the standard view and agent view of the Risky user report. Select a user from the list to see details for each linked account associated with a risky user, helping you understand the full scope of risk across a user's identity. When the Identity Risk Score is raised, the Microsoft Entra score is also raised, which can automatically trigger your risk-based Conditional Access policies.
The Identity Risk Score appears within the context of a selected user from the risky user report. The score, risk summary, and links to investigate further are provided to help you understand the risk and take appropriate action. Select the View full report in Microsoft Defender link to see the correlated signals in Microsoft Defender for Identity and investigate the risky user further.
For full details on how unified risk works, prerequisites, how to enable the feature, and troubleshooting, see Unified risk signals in Microsoft Entra ID Protection.
Take action on a risky user
[!INCLUDE id-protection-admin-action-user] \ No newline at end of file
diff --git a/docs/id-protection/concept-risky-user-report.md b/docs/id-protection/concept-risky-user-report.md index b4e27dc8bbd..d31584e01a1 100644 --- a/docs/id-protection/concept-risky-user-report.md +++ b/docs/id-protection/concept-risky-user-report.md @@ -53,14 +53,16 @@ The details include basic information about the user and a timeline of recent ri To see risk sign-in events together with risky user events, select the **Aggregate risk signals by risky sign-ins** checkbox. -### Unified risk signals (Preview) +### Unified risk signals -Microsoft Entra ID Protection now correlates signals from Microsoft Defender and other sources to provide unified risk signals for user risk detections. This preview feature enhances your risk detection capabilities by calculating a comprehensive Identity Risk Score based on multiple identity signals. This option must be enabled in [settings](id-protection-dashboard.md#unified-risk-signals-for-id-protection-user-risk-preview). +Microsoft Entra ID Protection correlates signals from Microsoft Defender and other sources to provide unified risk signals for user risk detections. This capability calculates a comprehensive Identity Risk Score based on multiple identity signals from across your identity fabric, including linked accounts and account sets. -You can view unified risk signals in both the standard view and agent view of the Risky user report. Select a user from the list to see details for each linked account associated with a risky user, helping you understand the full scope of risk across a user's identity, including linked accounts. When the Identity Risk Score is raised, the Microsoft Entra score is also raised using the unified risk signals, which can automatically trigger your risk-based Conditional Access policies. +You can view unified risk signals in both the standard view and agent view of the Risky user report. Select a user from the list to see details for each linked account associated with a risky user, helping you understand the full scope of risk across a user's identity. When the Identity Risk Score is raised, the Microsoft Entra score is also raised, which can automatically trigger your risk-based Conditional Access policies. The Identity Risk Score appears within the context of a selected user from the risky user report. The score, risk summary, and links to investigate further are provided to help you understand the risk and take appropriate action. Select the **View full report in Microsoft Defender** link to see the correlated signals in Microsoft Defender for Identity and investigate the risky user further. +For full details on how unified risk works, prerequisites, how to enable the feature, and troubleshooting, see [Unified risk signals in Microsoft Entra ID Protection](concept-identity-protection-unified-risk.md). + ## Take action on a risky user [!INCLUDE [id-protection-admin-action-user](../includes/id-protection-admin-action-user.md)] \ No newline at end of file