If an MFA prompt arrives that someone didn't trigger, they can flag it; ID Protection then treats them as high user risk and remediation follows. This replaced fraud alert, which went away on 1 March 2025.
Also called Fraud alert.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Report suspicious activity in context, with comparison tables and the common traps.
Terms in this definition
- MFA
Multifactor authentication: asking for another factor on top of a password at sign-in, usually required by a Conditional Access grant control.
- Azure Functions trigger
Every function is started by exactly one thing. That thing might be a web call over HTTP, a schedule, the arrival of a blob, a message landing in a queue or a change in a database.
- Microsoft Entra ID Protection
Uses risk scores on users and sign-ins to spot, look into and fix threats to identities. Policies that respond to that risk live in Conditional Access, and a Microsoft Entra ID P2 licence is required.
- User risk
Microsoft Entra ID Protection's assessment of how likely it is that an account has been compromised, for instance because its credentials have leaked. With Microsoft Entra ID P2 it can be used as a condition in Conditional Access.
- remediation
Applying updates through vSphere Lifecycle Manager, entering maintenance mode where needed, so that every cluster and host ends up compliant with its image or baselines. Readiness can first be confirmed by a pre-check that changes nothing.