Managing and resolving risk events

The Report section of Azure AD Identity Protection provides M365 administrators with the ability to review and resolve events and detections, as shown in the following screenshot:

Figure 5.23 – Reports

You will be able to carry out investigations based on what is recorded in these sections and take steps to resolve any risks, as well as unblock any users who may have been blocked, provided it's safe to do so.

Let's look at each of the options within the Report section in detail.

Examining users at risk

A risky user is someone who's activity has matched a risk level set in Azure ID Identity Protection. When a risk is detected, alerts will be sent to administrators, as shown earlier in this chapter. However, it is important to proactively review the list of users at risk in Azure AD Identity Protection in the Azure portal and take corrective actions.

Under Risky Users, you will see a list of...