Microsoft Entra ID Protection
AuthenticationIdentity Protection Policies
In brief
The documentation replaces “Device disablement” with “Attacker-added device” and explains that the Entra device object is disabled, new token issuance is blocked, existing device-bound refresh tokens are revoked, and user sessions are revoked.
What Entra admins need to know
Administrators should use the updated description when assessing the remediation’s security impact. No new administrator action is specified.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Password authentication: Risky user has an active risk detection, such as a leaked credential, password spray, or session history involving a compromised password. The user is prompted to perform a secure password change and when completed, their previous sessions are revoked.
- Passwordless authentication: Risky user has an active risk detection, but it doesn't involve a compromised password. Possible risk detections include anomalous token, impossible travel, or unfamiliar sign-in properties. The user's sessions are revoked and they're prompted to sign in again.
Device disablementAttacker-added device: Risky user is flagged by Microsoft's threat intelligence as having a device added by an attacker. The Entra device object is disabled, blocking new token issuance andtherevoking existing device-bound refresh tokens. The useris's sessions are revoked, and they're prompted tosignsign-infrom a trusted device.again.
Special considerations
@@ -45,7 +45,7 @@ This control uses adaptive risk remediation to let you author a Conditional Acce - **Password authentication**: Risky user has an active risk detection, such as a leaked credential, password spray, or session history involving a compromised password. The user is prompted to perform a secure password change and when completed, their previous sessions are revoked. - **Passwordless authentication**: Risky user has an active risk detection, but it doesn't involve a compromised password. Possible risk detections include anomalous token, impossible travel, or unfamiliar sign-in properties. The user's sessions are revoked and they're prompted to sign in again.-- **Device disablement**: Risky user is flagged by Microsoft's threat intelligence as having a device added by an attacker. The device is disabled, and the user is prompted to sign in from a trusted device. +- **Attacker-added device**: Risky user is flagged by Microsoft's threat intelligence as having a device added by an attacker. The Entra device object is disabled, blocking new token issuance and revoking existing device-bound refresh tokens. The user's sessions are revoked, and they're prompted to sign-in again. #### Special considerations