Microsoft Entra ID Protection

Identity Protection Risks

15 October 2026Feature update+1 / −1 lines

In brief

The risk detection table now lists Atypical travel as “Real-time” instead of “Offline.” Its Premium requirement and unlikelyTravel identifier are unchanged.

What Entra admins need to know

Review documentation or operational expectations that refer to atypical travel processing timing.

This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

@@ -31,7 +31,7 @@ Select a risk detection from the list to view the description of the risk detect | [Admin confirmed user compromised](#admin-confirmed-user-compromised) | Offline | Nonpremium | adminConfirmedUserCompromised | | [Anomalous Token (sign-in)](#anomalous-token-sign-in) | Real-time or Offline | Premium | anomalousToken |  | [Anonymous IP address](#anonymous-ip-address) | Real-time | Nonpremium | anonymizedIPAddress |-| [Atypical travel](#atypical-travel) | Offline | Premium | unlikelyTravel |+| [Atypical travel](#atypical-travel) | Real-time | Premium | unlikelyTravel | | [Impossible travel](#impossible-travel) | Offline | Premium | mcasImpossibleTravel | | [Malicious IP address](#malicious-ip-address) | Offline | Premium | maliciousIPAddress | | [Mass Access to Sensitive Files](#mass-access-to-sensitive-files) | Offline | Premium | mcasFinSuspiciousFileAccess |