What risk detection types does Microsoft Entra ID Protection use?

What Microsoft Entra ID Protection is telling you with these two detections

microsoft entra id protection splits detection into two complementary views because they answer different operational questions. Identity Threat Detection and Response (ITDR) Guide is useful context for this distinction: one signal is about the event, the other is about the account. That separation helps teams avoid overreacting to a single suspicious login while still treating repeated account-level risk as a potential compromise.

Sign-in risk is the event-level view. It asks whether a specific authentication attempt looks suspicious based on properties such as unfamiliar behavior, impossible travel, token abuse, or other abnormal patterns. User risk is the account-level view. It asks whether the identity itself may be compromised, even if the most recent sign-in does not by itself prove abuse.

The practical value is correlation. A single risky sign-in may be transient, such as a blocked attempt or an isolated anomaly, while user risk suggests a wider trust problem that can persist across sessions and devices. In Microsoft Entra environments, that distinction is especially important when identity is the control plane for access decisions, because the wrong response can leave a compromised account active or can unnecessarily disrupt a legitimate user.

How to interpret sign-in risk versus user risk in practice

Sign-in risk is best read as “should this login be challenged, blocked, or step-up authenticated right now?” User risk is best read as “should this account be treated as potentially compromised until proven otherwise?” The first is immediate and transaction-specific. The second is cumulative and remediation-oriented.

That means the same person can produce a risky sign-in without requiring full account remediation, especially if the event is contained and no further evidence appears. By contrast, repeated user risk signals usually justify a stronger response because they indicate the account may have been used across multiple attempts, devices, or sessions in ways that are harder to dismiss as noise.

Entra ID Applications and Consent Guide is relevant here because risky sign-ins and account compromise often interact with consent abuse, token theft, and over-permissioned applications. If the account can grant access or approve an app, user risk becomes more than a login concern and starts to affect tenant-wide exposure.

Privileged Identity Management (PIM) Guide also matters when the risky identity holds elevated roles. For privileged users, user risk should be treated as a high-priority signal because the blast radius includes administrative actions, not just mailbox or file access.

What this means for investigation and response

Use sign-in risk to decide whether the specific authentication event deserves challenge, review, or immediate containment. Use user risk to decide whether the account needs stronger verification, credential reset, session revocation, or broader compromise handling. The two signals should be reviewed together, not in isolation, because one explains the event and the other explains the identity state.

When both signals appear together, treat the account as higher confidence compromise evidence than either signal alone. When only sign-in risk appears, look for supporting indicators before escalating to full account response. When only user risk appears, assume there may be prior exposure or latent abuse even if the latest sign-in looks clean.

Identity Threat Detection and Response (ITDR) Guide supports that approach by emphasizing detection across identity behavior, not just point-in-time authentication events. The response question is not “was this one login bad?” but “does the identity still deserve trust?”

Active Directory and Entra ID Hardening Guide is relevant because weak identity posture makes both risk types more common and more dangerous. If the same account has broad privileges, legacy authentication exposure, or poor conditional access coverage, the cost of a missed user-risk signal rises quickly.

Risk and Threat Considerations

These detections matter because attackers often start with a suspicious sign-in and then pivot into sustained account abuse. A single event may be blocked, but repeated user risk can indicate token theft, credential stuffing, phishing success, or session abuse that has already moved past the original login attempt.

Failure mechanism: Treating sign-in risk as equivalent to user risk, or ignoring user risk after one apparently benign login, can leave a compromised identity active long enough for token replay, mailbox access, consent abuse, or privileged action.

Impact: The result can be missed lateral movement, unauthorized data access, or continued access by an attacker who no longer needs to keep producing obviously suspicious sign-ins.

Practitioner Guidance

What to verify: Check whether the risky sign-in is isolated or part of a pattern across devices, locations, or sessions. Then verify whether the account has any privileged roles, delegated app access, or recent consent activity that would increase the importance of the user-risk signal.

Decision rule: If only sign-in risk is present, focus on the transaction and surrounding context. If user risk is present, treat the account as potentially compromised until you have evidence that the identity, sessions, and any exposed secrets have been recovered.

Practitioner takeaway: Sign-in risk tells you whether to distrust a login event, while user risk tells you whether to distrust the account itself, and that second judgment should drive your containment priority.

Related resources from NHI Mgmt Group

• How do you configure risk-based Conditional Access policies with Microsoft Entra ID Protection?
• How do you configure risk policies in Microsoft Entra ID Protection?
• How do you simulate risk detections in Microsoft Entra ID Protection?
• Anomalous Token Detection (Microsoft Entra ID Protection)