https://DevOpsCloud.io -- Cloud Monk Losang Jinpa

“Azure Active Directory Identity Protection provides a consolidated view of at risk Azure AD users, risk events and vulnerabilities, with the ability to remediate risk immediately, and set Azure policies to auto-remediate future events. This Azure service is built on Microsoft’s experience protecting consumer identities, and gains tremendous accuracy from the signal from over 13B logins a day.

• Discover users flagged for risk
• Detect users flagged for risk and investigate risk events for the user.

Learn more: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview#what-is-a-user-risk-level

• Discover risk events
• Detect and investigate risk events like users with leaked credentials, sign-ins from anonymous IP address, etc. Learn more - https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-risk-events

• Discover vulnerabilities
• Detect weaknesses in your environment that you can fix to improve your security posture. - Learn more - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/vulnerabilities

• Mitigate risk events

• Enable policy to require multi-factor authentication or block sign-in based on sign-in risk. Learn more - https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview#mitigating-sign-in-risk-events
• Remediate users
• Manually password reset for a user or enable policy for password reset or blocking sign-in based on user risk.

• https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview
• Azure AD Identity Protection