Finding at-risk users
At-risk users are those flagged for unusual behavior, such as suspicious sign-ins or unfamiliar sign-in properties. Identifying and addressing these users is critical for maintaining the security of your organization. This recipe will guide you through the steps to find and manage at-risk users using Microsoft Entra ID Protection.
Getting ready
Ensure that you have a Microsoft Entra ID P1 or P2 license and are a Global or Security Administrator.
How to do it…
- Go to the Microsoft Entra admin center at https://entra.microsoft.com.
- Select Protection from the left navigation menu and then Identity Protection, as shown in Figure 14.1.
Figure 14.1 – Location of Identity Protection in Microsoft Entra
- Under the Report section, select Risky users.
- Review the list of users with a risk state of At risk or change the list’s filters to view users who are Confirmed compromised, Remediated,...
