Microsoft Entra ID Protection
FundamentalsWhat are risk detections?
In brief
The documentation now describes a real-time Identity Protection detection for suspiciously added authentication methods. It raises user risk and can trigger configured risk-based policies; the page lists Microsoft Entra ID P2 as required, pending confirmation.
What Entra admins need to know
Administrators should account for this detection when reviewing risk-based policies and licensing.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
What are risk detections?
| Microsoft Entra threat intelligence (user) | Real-time or Offline | Nonpremium | investigationsThreatIntelligence | | Possible attempt to access Primary Refresh Token (PRT) | Offline | Premium | attemptedPrtAccess | | Suspicious API Traffic | Offline | Premium | suspiciousAPITraffic | | Suspicious credential addition | Real-time | Premium | TBD | | Suspicious sending patterns | Offline | Premium | suspiciousSendingPatterns | | User reported suspicious activity | Offline | Premium | userReportedSuspiciousActivity |
- Calculated offline
- License requirement: Microsoft Entra ID P2
Suspicious credential addition
This detection identifies when a new authentication method is added to an account under suspicious circumstances. This might indicate that an attacker has accessed the account and is trying to maintain access by registering a new credential.
Microsoft Entra ID Protection raises user risk when this activity is detected, allowing organizations to respond through their configured risk-based policies.
- Calculated in real-time
- License requirement: Microsoft Entra ID P2
Suspicious sending patterns
This risk detection type is discovered using information provided by Microsoft Defender for Office 365 (MDO). This alert is generated when someone in your organization sent suspicious email and is either at risk of being or is restricted from sending email. This detection moves users to medium risk and only fires in organizations that deploy MDO. This detection is low-volume and is seen infrequently in most organizations.
@@ -3,8 +3,10 @@ title: What are risk detections? description: Explore the full list of risk detections and their corresponding risk event types, along with a description of each risk event type. ms.service: entra-id-protection ms.topic: reference-ms.date: 04/22/2026+ms.date: 10/19/2026 ms.reviewer: lvandenende+ai-usage: ai-assisted+ms.custom: msecd-doc-authoring-1030 --- # What are risk detections?@@ -61,6 +63,7 @@ Select a risk detection from the list to view the description of the risk detect | [Microsoft Entra threat intelligence (user)](#microsoft-entra-threat-intelligence-user) | Real-time or Offline | Nonpremium | investigationsThreatIntelligence | | [Possible attempt to access Primary Refresh Token (PRT)](#possible-attempt-to-access-primary-refresh-token-prt) | Offline | Premium | attemptedPrtAccess | | [Suspicious API Traffic](#suspicious-api-traffic) | Offline | Premium | suspiciousAPITraffic |+| [Suspicious credential addition](#suspicious-credential-addition) | Real-time | Premium | TBD | | [Suspicious sending patterns](#suspicious-sending-patterns) | Offline | Premium | suspiciousSendingPatterns | | [User reported suspicious activity](#user-reported-suspicious-activity) | Offline | Premium | userReportedSuspiciousActivity | @@ -298,6 +301,17 @@ This risk detection is reported when abnormal GraphAPI traffic or directory enum - Calculated offline - License requirement: Microsoft Entra ID P2 +### Suspicious credential addition++<!-- TODO: Confirm the Premium license requirement and replace the TBD riskEventType in the user risk detections table before publishing. -->++This detection identifies when a new authentication method is added to an account under suspicious circumstances. This might indicate that an attacker has accessed the account and is trying to maintain access by registering a new credential.++Microsoft Entra ID Protection raises user risk when this activity is detected, allowing organizations to respond through their configured risk-based policies.++- Calculated in real-time+- License requirement: Microsoft Entra ID P2+ ### Suspicious sending patterns This risk detection type is discovered using information provided by [Microsoft Defender for Office 365 (MDO)](/defender-office-365/air-about). This alert is generated when someone in your organization sent suspicious email and is either at risk of being or is restricted from sending email. This detection moves users to medium risk and only fires in organizations that deploy MDO. This detection is low-volume and is seen infrequently in most organizations.