iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A risky sign-in is an investigation signal, not proof that an account was taken over. Start in Microsoft Entra ID Protection, open Protection > Identity Protection > Risky sign-ins or Risky users, and examine the event against the user’s normal activity. If the evidence indicates an attacker, contain the account immediately: mark the event or user as compromised, force a secure password reset, block sign-in when the attacker may still control credentials or authentication, and revoke refresh tokens and sessions. Then review audit and sign-in logs for persistence or lateral movement.
If the activity is legitimate, document why and mark it safe or dismiss the risk only after checking the application, IP address, location, user agent, device, and timing. Risk-based Conditional Access can require MFA, a secure password change, or blocking automatically, but MFA registration, self-service password reset (SSPR), phishing-resistant methods for administrators, and a tested emergency-access path must be ready before enforcement.
What a risky sign-in means in Microsoft 365
Microsoft Entra ID Protection assigns risk when sign-in telemetry resembles activity associated with compromised credentials or an attacker. A detection can be triggered by an unusual location, unfamiliar device or browser, leaked credentials, atypical token behavior, or other signals. The alert is a prompt to investigate; it is not conclusive evidence that the person is malicious or that the account is compromised.
Free tools Windows power users keep installed
One-click scans. No signup required.
Two views answer different questions:
- Risky sign-ins focuses on individual authentication events. It is the right starting point when one login, application, IP address, or device looks abnormal.
- Risky users shows the account-level condition when one or more detections indicate that the user’s identity may be at risk.
Risk records can show states such as at risk, confirmed compromised, confirmed safe, dismissed, and remediated. A status change records a decision; it does not replace checking what happened before and after the alert.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
First response: investigate the event before changing its status
Open the risk detail
- Sign in to the Microsoft Entra admin center with an account authorized to view Identity Protection data.
- Go to Protection > Identity Protection > Risky sign-ins. If the concern is broader than one event, use Protection > Identity Protection > Risky users.
- Open the event and record the user, timestamp, application, authentication result, risk detection, IP address, country or region, user agent, device information, and any Conditional Access result.
- Open the user’s sign-in history around the same time. Look for preceding successful logins, failed attempts, password changes, MFA changes, and access to applications the user does not normally use.
Compare the evidence with normal behavior
Ask the user or their manager whether the person was traveling, using a corporate VPN, working from a new office, signing in through a new browser, or setting up a replacement device. A location can be misleading when traffic exits through a VPN or cloud service. A familiar user agent can also be copied, so treat it as one signal rather than proof.
Higher-confidence warning signs include an unexplained country or city combined with a new device, an unfamiliar application, a successful login at a time the user was not working, impossible travel that cannot be explained by a VPN, or a sequence of failures followed by a successful sign-in. A leaked-credential detection is especially serious when the password is still in use or the logs show access that the user cannot explain.
Choose a disposition
Use confirmed safe only when the evidence and the user’s explanation fit the event. Use dismissed when the detection is not actionable but you have recorded why. Use confirmed compromised when unauthorized access is established or strongly indicated. If the alert is still being investigated, leave it at risk while containment and log review proceed. Microsoft’s guidance is that once risk is contained, additional investigation may still be required before marking it safe, compromised, or dismissing it.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallContain an account that may be compromised
Containment takes priority over a perfect explanation. An attacker who can still authenticate, reset a password, or approve MFA can undo later cleanup.
1. Mark the risk as compromised
In the risky sign-in or risky-user record, choose the action that marks the event or user as confirmed compromised. This preserves the security decision in Entra and helps risk-based policies respond consistently. Do not use “dismiss” to make an active incident disappear.
2. Block access when control may still be active
Block the user when there is evidence of an active attacker, when the password may be known, when MFA methods may have been changed, or when you cannot quickly verify the user’s identity. Blocking is also appropriate when the account has privileged roles and the blast radius is high. Coordinate with the service desk so a legitimate employee has a verified support path while the block is in place.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
3. Force a secure password reset
Reset the password through the organization’s approved administrative process, or require a secure password change through SSPR when the user can still prove control of an enrolled, trusted method. Do not send a temporary password through the same email account or chat channel that may be under attacker control. Have the user create a new, unique password that has not been used on another service.
For a leaked credential, Microsoft recommends assessing the exposure, checking whether the password has already changed, and, when unauthorized access is present, blocking the user, resetting the password, and revoking refresh tokens.
4. Revoke refresh tokens and sessions
Password changes do not reliably terminate every existing session. Revoke the user’s refresh tokens and sign-in sessions using the account’s available Entra action, then require the user to authenticate again. This limits the usefulness of tokens an attacker obtained before the reset. Expect a short propagation period across services and verify that previously active sessions no longer reach Microsoft 365 resources.
5. Verify authentication methods
Open the user’s authentication-method management view and compare every method with the user’s records. Remove phone numbers, authenticator registrations, passkeys, security keys, or other methods the user did not add. Require the legitimate user to register methods again through a trusted process. A password reset is insufficient if the attacker added an authenticator or changed the phone number used for recovery.
Investigate persistence and lateral movement
After access is contained, search the Entra audit logs, sign-in logs, Microsoft 365 audit data, and relevant workload logs for changes made during the suspicious period. Work from the first unexplained event through the containment time.
Identity and privilege changes
- New or modified app registrations, enterprise applications, service principals, delegated permissions, certificates, or client secrets.
- Added owners or credentials on an application that could provide continuing access.
- Changes to directory roles, group membership, administrative-unit scope, or role assignments.
- New authentication methods, altered MFA details, changed SSPR information, or edits to security defaults and Conditional Access policies.
- Creation of accounts, guest invitations, or changes to user account status.
Mailbox and collaboration changes
- New inbox, forwarding, transport, or mailbox rules that hide messages or send copies externally.
- Changes to mailbox delegates, shared-mailbox permissions, calendar sharing, or application access.
- Unusual downloads, searches, file sharing, or access to sensitive SharePoint, OneDrive, Teams, or compliance content.
What to do with findings
Export or preserve the relevant records according to your incident-response policy. Remove unauthorized rules, permissions, app credentials, role assignments, and sessions only after documenting them. If the compromised account had administrative rights, investigate the accounts and resources it could reach, not just the original user. Escalate to your security incident-response team when you find persistence, data access, privilege changes, or evidence that more than one identity is involved.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When the sign-in is legitimate
Do not train staff to approve every alert. Confirm the details with the person through a trusted channel, not by replying to a potentially compromised mailbox. Ask what device and network they used, which application they opened, and whether they recently changed password or MFA settings. Check that those answers match the event data.
Once the activity is explained, record the reason and mark the event confirmed safe or dismissed, according to your tenant’s process. If similar alerts recur for a legitimate VPN, proxy, travel pattern, or managed-device transition, address the underlying sign-in design rather than repeatedly dismissing detections. Keep an eye on later events because a safe decision applies to the reviewed activity, not to every future login from the same user.
Use risk-based Conditional Access for automatic remediation
Risk-based Conditional Access can turn a detection into a controlled user experience instead of relying on a manual response for every event. The appropriate control depends on the risk type and the assurance you require.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors| Condition or outcome | Typical control | What must be ready first |
|---|---|---|
| Risky sign-in that may be legitimate but needs stronger proof | Require multifactor authentication | Users must have a working MFA method and a tested recovery path. |
| High user risk or evidence that a password may be exposed | Require a secure password change through SSPR | SSPR registration, writeback or other directory requirements, and help-desk procedures must be configured. |
| Risk that cannot be safely remediated interactively | Block access | Administrators need an emergency-access path and a way to investigate without using the blocked identity. |
Scope policies deliberately. Start with a pilot group, validate sign-in and recovery flows, and monitor the resulting sign-in logs before expanding. A policy that requires a method a user has not registered will create help-desk failures rather than reduce risk.
Protect against administrator lockout
Register the required authentication methods before enabling an enforcement policy. Maintain at least one tested emergency-access (“break-glass”) account that is excluded from ordinary Conditional Access policies and is protected, monitored, and used only for recovery. Test the account on a schedule and after major policy changes; an account that exists but cannot be used is not an emergency plan.
Keep emergency credentials under controlled access, alert on every use, and document who may retrieve them. Do not use the emergency account for routine administration or as a convenience when a normal administrator is unavailable.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Strengthen administrator authentication
Privileged administrators should use phishing-resistant MFA rather than relying only on codes or push approvals that can be phished or socially engineered. Microsoft documents FIDO2 security keys, passkeys, Windows Hello for Business, and certificate-based methods for this purpose.
A FIDO2 security key is a physical authenticator that can use USB, NFC, or Bluetooth, depending on the key and device. Its private key never leaves the security key, which prevents a remote phishing site from collecting the private key. Before purchasing or deploying one, verify the connector type, operating-system and browser support, the Microsoft Entra passkey profile, attestation requirements, and the licensing or tenant configuration needed for your scenario. Use at least two registered methods for highly privileged users so a lost key does not become an outage.
Recovery paths for different incident conditions
| Observed condition | Immediate response | Recovery path |
|---|---|---|
| Expected travel, VPN, or new managed device; no other anomaly | Verify with the user and inspect surrounding events. | Require MFA if policy calls for it, then mark the reviewed event safe or dismiss it with a record. |
| Unknown location, application, or device with a successful login | Block if the user cannot promptly verify it; revoke sessions and reset the password. | Re-register authentication methods and review mailbox, app, and privilege changes. |
| Leaked credential plus unexplained access | Block the account, reset the password, revoke refresh tokens and sessions. | Investigate all resources reached by the account and remove persistence. |
| Authentication method or app registration changed by an unknown actor | Block and preserve logs before cleanup. | Remove unauthorized methods and app credentials, check role assignments, and involve incident response. |
| Privileged administrator at risk | Use a separate trusted administrator or emergency-access account; contain the affected identity immediately. | Require phishing-resistant MFA, audit every privileged action, and review accounts and policies within the administrator’s reach. |
Troubleshoot common remediation failures
The user still receives prompts after a reset
Confirm that refresh tokens and sessions were revoked, not just the password. Check for a second active device, a mobile mail client, or an application using a long-lived connection. Review new sign-ins after the revocation time and repeat containment if unexplained activity continues.
The user cannot complete SSPR or MFA
Do not weaken the policy during an incident. Verify that the enrolled methods belong to the user and were not replaced by an attacker. Use an administrator-driven reset and authentication-method re-registration through a verified identity-check process. If the account is blocked, provide a separate support channel that does not depend on the affected mailbox.
A Conditional Access change locked out administrators
Use the tested emergency-access account or another excluded, trusted administrator to revert or narrow the policy. After access is restored, register the required phishing-resistant methods, test the policy with a pilot group, and confirm that emergency accounts remain excluded and monitored.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Alerts keep appearing after a safe decision
Review each new event instead of reusing the previous disposition. Compare the source network, device, application, and authentication result. Repeated legitimate alerts may indicate a VPN or device-management design issue, while a changed pattern can indicate a new compromise.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A practical incident checklist
- Open Risky sign-ins and Risky users in Entra ID Protection.
- Record the event details and compare them with the user’s normal behavior.
- Contact the user through a trusted channel when confirmation is needed.
- For suspected compromise, mark the risk compromised, block when necessary, reset the password, and revoke refresh tokens and sessions.
- Inspect authentication methods, app registrations, permissions, role assignments, mailbox rules, forwarding, and sensitive-resource access.
- Preserve relevant audit and sign-in records and escalate findings that indicate persistence, privilege escalation, or data access.
- For legitimate activity, document the explanation and mark the reviewed risk safe or dismissed.
- Validate MFA, SSPR, risk-based Conditional Access, phishing-resistant administrator methods, and emergency-access procedures before enforcing them broadly.
How to prevent the next risky sign-in
Make enrollment and recovery part of normal account setup, not an emergency improvisation. Require administrators and other high-value users to register phishing-resistant methods, maintain more than one trusted method where policy allows, and test recovery without exposing credentials to the help desk. Use managed-device controls and least-privilege roles to reduce the damage a stolen session can cause.
Review Conditional Access policies after organizational changes, VPN changes, application onboarding, and directory-role changes. Keep policy exclusions minimal, explicit, and monitored. Schedule exercises that use the emergency-access path and verify that logs, alerts, and ownership are still correct.
The durable fix is a combination of accurate investigation, fast containment, token and method cleanup, and controls that make the same attack harder to repeat. Treat every risk alert as a decision requiring evidence, while treating confirmed compromise as an incident requiring immediate containment.
Frequently Asked Questions
Does a risky sign-in prove that the account was hacked?
No. It is a detection signal. Check the application, IP address, location, user agent, device, timing, and surrounding sign-ins before marking the event safe, dismissed, or compromised.
Is changing the password enough after an account compromise?
No. Revoke refresh tokens and sessions, inspect authentication methods, app registrations, permissions, mailbox rules, and role changes. An attacker may retain access through a token or a method added before the password reset.
When should I block the user instead of allowing self-service remediation?
Block when an attacker may still control the password or MFA, when unauthorized access is confirmed, when authentication methods were changed, or when a privileged account is involved. Use MFA or secure SSPR remediation only when the user can prove control through trusted, enrolled methods.
What should administrators register before enabling phishing-resistant MFA policies?
Register the required phishing-resistant method, such as a FIDO2 security key, passkey, Windows Hello for Business, or certificate-based method. Also test an emergency-access account that is excluded from the policy so a configuration mistake cannot lock out every administrator.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
