Microsoft Entra ID Identity Protection uses machine learning across billions of sign-ins to detect when an account has been compromised — often before the user or IT team even knows. Here's how to configure it.
Key takeaways
- 1Atypical travel — signing in from Auckland at 9am and London at 10am is physically impossible (impossible travel)
- 2Leaked credentials — Microsoft monitors the dark web and hacking forums; if your user's credentials appear in a breach dump, you're alerted
- 3Anonymous IP address — sign-ins from Tor exit nodes or known proxy services
- 4Password spray — attackers trying common passwords across many accounts
- 5Malware-linked IP addresses — sign-ins from IPs known to be part of malware command-and-control networks
Microsoft's identity platform processes billions of sign-in events globally every day. That scale provides something unique: the ability to detect attack patterns that would be invisible in a single organisation's data. Entra ID Identity Protection is the product that puts this intelligence to work for your business.
What Identity Protection detects
- Atypical travel — signing in from Auckland at 9am and London at 10am is physically impossible (impossible travel)
- Leaked credentials — Microsoft monitors the dark web and hacking forums; if your user's credentials appear in a breach dump, you're alerted
- Anonymous IP address — sign-ins from Tor exit nodes or known proxy services
- Password spray — attackers trying common passwords across many accounts
- Malware-linked IP addresses — sign-ins from IPs known to be part of malware command-and-control networks
- Token replay — when a session token stolen via AiTM phishing is used in a different location
Risk-based Conditional Access
Identity Protection integrates with Conditional Access to automate responses. You can create policies that say: if sign-in risk is High, block access or require MFA. If user risk is High (credential leaked), require password change before allowing access. This happens automatically — no manual intervention required.
What Optimyze configures
Optimyze deploys Identity Protection risk policies for every Business Premium client. We review the risk detections report monthly, follow up on any high-risk sign-ins that weren't automatically remediated, and tune the policies as your organisation evolves. The risky users report is reviewed before every monthly client check-in.
