Microsoft Entra ID Protection
AuthenticationIdentity Protection Risks
In brief
The documentation now describes adaptive learning for new users’ sign-in behavior and says detection is calculated in real time, replacing the previous learning-period and offline-calculation details.
What Entra admins need to know
Administrators should use the updated description when interpreting atypical travel risk detections. No action is required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
This risk detection type identifies two sign-ins originating from geographically distant locations, where at least one of the locations might also be atypical for the user, given past behavior. The algorithm takes into account multiple factors including the time between the two sign-ins and the time it would take for the user to travel from the first location to the second. This risk might indicate that a different user is using the same credentials.
The algorithm ignores obvious "false positives" contributingsystem uses adaptive learning to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learnslearn a new user's sign-in behavior.
- Calculated
offlinein real-time - License requirement: Microsoft Entra ID P2
- Tips for investigating atypical travel detections.
@@ -120,9 +120,9 @@ This risk detection type indicates sign-ins from an anonymous IP address (for ex This risk detection type identifies two sign-ins originating from geographically distant locations, where at least one of the locations might also be atypical for the user, given past behavior. The algorithm takes into account multiple factors including the time between the two sign-ins and the time it would take for the user to travel from the first location to the second. This risk might indicate that a different user is using the same credentials. -The algorithm ignores obvious "false positives" contributing to the impossible travel conditions, such as VPNs and locations regularly used by other users in the organization. The system has an initial learning period of the earliest of 14 days or 10 logins, during which it learns a new user's sign-in behavior. +The system uses adaptive learning to learn a new user's sign-in behavior. -- Calculated offline+- Calculated in real-time - License requirement: Microsoft Entra ID P2 - [Tips for investigating atypical travel detections.](howto-identity-protection-investigate-risk.md#atypical-travel-detections)