Microsoft Entra ID Protection
AuthenticationIdentity Protection Policies
In brief
The documentation now describes a Device disablement response for users flagged by Microsoft threat intelligence as having an attacker-added device. The device is disabled, and the user is prompted to sign in from a trusted device.
What Entra admins need to know
Administrators should be aware of this documented response when reviewing risky-user remediation behavior.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
- Password authentication: Risky user has an active risk detection, such as a leaked credential, password spray, or session history involving a compromised password. The user is prompted to perform a secure password change and when completed, their previous sessions are revoked.
- Passwordless authentication: Risky user has an active risk detection, but it doesn't involve a compromised password. Possible risk detections include anomalous token, impossible travel, or unfamiliar sign-in properties. The user's sessions are revoked and they're prompted to sign in again.
- Device disablement: Risky user is flagged by Microsoft's threat intelligence as having a device added by an attacker. The device is disabled, and the user is prompted to sign in from a trusted device.
Special considerations
@@ -45,6 +45,7 @@ This control uses adaptive risk remediation to let you author a Conditional Acce - **Password authentication**: Risky user has an active risk detection, such as a leaked credential, password spray, or session history involving a compromised password. The user is prompted to perform a secure password change and when completed, their previous sessions are revoked. - **Passwordless authentication**: Risky user has an active risk detection, but it doesn't involve a compromised password. Possible risk detections include anomalous token, impossible travel, or unfamiliar sign-in properties. The user's sessions are revoked and they're prompted to sign in again.+- **Device disablement**: Risky user is flagged by Microsoft's threat intelligence as having a device added by an attacker. The device is disabled, and the user is prompted to sign in from a trusted device. #### Special considerations