You have a Microsoft Entra tenant. You open the risk detections report. Which risk detection type is classified as a user risk?

Question

Options

• Apassword spray
• Banonymous IP address
• Cunfamiliar sign-in properties
• DMicrosoft Entra threat intelligence

• A
  3% (1)
• B
  6% (2)
• C
  3% (1)
• D
  87% (27)

Explanation

Microsoft Entra Threat Intelligence as a User Risk

"Microsoft Entra threat intelligence" is classified as a user risk because it detects risk based on Microsoft's internal and external threat intelligence sources that indicate a user account has been compromised - this risk is tied to the user identity itself, not a specific sign-in event. Options A (password spray), B (anonymous IP address), and C (unfamiliar sign-in properties) are all classified as sign-in risks, meaning they are associated with suspicious characteristics of a specific authentication attempt rather than the overall user account state. Note that while "Microsoft Entra threat intelligence" also exists as a sign-in risk detection type, when it appears in the context of user risk, it specifically flags users whose credentials are suspected to be compromised based on threat intel data.

Memory Tip: Think of it this way - sign-in risks are about how or where someone is logging in (anonymous IP, unfamiliar location, password spray targeting a session), while user risks are about who the user is and whether their identity/credentials are compromised. "Threat intelligence" at the user level = compromised identity = user risk.

No community discussion yet for this question.