Active Directory Administration Cookbook

How it works...

Azure AD Identity Protection is enabled for every Azure AD account and every Microsoft account, formerly known as Windows Live ID. Every authentication goes through the Identity Protection funnel, where Microsoft's Machine Learning (ML) tries to distinguish risky and bad sign-ins from valid ones. Accounts that see a lot of risky and bad sign-ins, or have their password breached, become marked as risky users.

Azure Identity Protection offers additional investigation and configuration mechanisms for risky sign-ins and risky users. In the Azure AD Identity Protection dashboard, admins can do the following:

• Investigate users flagged for risk, risk events, and vulnerabilities
• Configure MFA registration, user risk policies, and ...