Identity protection

As explained in Azure Security

Identity protection is a Microsoft Entra capability that detects identity and sign-in compromise risk using behavioral analysis and supports protective responses.

Identity protection detects suspicious identities and sign-ins by learning usual user behavior and distinguishing anomalous activity. It supports automated responses such as MFA, password changes, or blocked access, while requiring layered Azure security because compromised identities can enable lateral movement. section 1.8.1 section 2.2.5

Identity protection can detect risks including:

• Anonymous IP addresses, including Tor exit nodes and anonymizer VPNs. section 2.2.5
• Atypical travel, leaked credentials, malware-linked IP addresses, unfamiliar sign-in properties, and suspicious browsers. section 2.2.5
• Risk at both the identity level and the individual sign-in level. section 2.2.5

Configure a user risk policy in the Azure portal:

• Sign in with the Global Administrator or Security Administrator role, open Azure Active Directory, and select Security under Manage. section 2.2.6
• Open Identity Protection under Protect, choose User Risk Policy, and select the users covered by the policy. section 2.2.6
• Set the triggering threshold to High, Medium and Above, or Low and Above. section 2.2.6
• Choose Block Access, or allow access while optionally requiring a password change. section 2.2.6

Figure 1.5 Azure security services that can be used to secure identities in your Azure environment

Relate identity protection to the wider attack path, including suspicious sign-ins, compromised privileged identities, lateral movement, and Microsoft Sentinel response. section 1.8.1

How Azure Security covers it

How deep it goes

Explains behavioral baselines, detection types, policy parameters, and portal configuration, but stops short of sign-in policy configuration.

Examples

Uses unfamiliar remote location, Bob’s risky sign-in, leaked credentials, atypical travel, and portal policy configuration.

What it assumes

Requires Azure AD Premium P2 coverage and Global Administrator or Security Administrator access to configure policies.

What you can do after

Operate/configure user risk policies that block access or require password changes when selected risk thresholds are reached.

How it connects

Connects Microsoft Entra ID, machine learning, multifactor authentication, password changes, Microsoft Sentinel, and lateral movement.

liveBookmanning.com

Read Azure Security on liveBook Get the book at manning.com

Related concepts

• machine learninguses · Machine learning is a field of computational methods in which systems learn patterns or relationships from data to make predictions, decisions, or other outputs.
• Microsoft Entra IDpart of · Microsoft Entra ID is Microsoft's cloud-based identity and access-management service for authenticating users, applications, and services and controlling their access to resources.
• conditional accessalternative to · Conditional access is an access-control technique that grants or denies requests according to contextual conditions and policy requirements.

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.