1
00:00:00,040 --> 00:00:03,919
Welcome to the M365 FM podcast,
where we explore the people,
2
00:00:03,919 --> 00:00:07,080
ideas and technologies shaping
the future of work.
3
00:00:07,080 --> 00:00:08,560
Microsoft says more than ninety
4
00:00:08,560 --> 00:00:09,640
seven percent of identity
5
00:00:09,640 --> 00:00:10,800
attacks are just password
6
00:00:10,800 --> 00:00:11,480
attacks.
7
00:00:11,480 --> 00:00:12,880
The usual way into a Microsoft
8
00:00:12,880 --> 00:00:14,039
three hundred sixty five account
9
00:00:14,039 --> 00:00:15,160
is a password that leaked
10
00:00:15,160 --> 00:00:15,880
somewhere else.
11
00:00:15,880 --> 00:00:16,920
Not a clever hack.
12
00:00:16,920 --> 00:00:18,879
Microsoft Enter ID protection is
13
00:00:18,879 --> 00:00:20,039
the part of Microsoft's cloud
14
00:00:20,039 --> 00:00:21,359
that watches those sign ins and
15
00:00:21,359 --> 00:00:22,679
flags the accounts that look
16
00:00:22,679 --> 00:00:23,239
stolen.
17
00:00:23,239 --> 00:00:27,440
Welcome to the M365 FM podcast,
where we explore the people,
18
00:00:27,440 --> 00:00:30,239
ideas and technologies shaping
the future of work.
19
00:00:30,239 --> 00:00:32,759
It doesn't lock everyone out
because it scores the risk and
20
00:00:32,759 --> 00:00:34,759
then asks the person to prove
it's really them.
21
00:00:34,759 --> 00:00:36,119
By the end, you'll know how that
22
00:00:36,119 --> 00:00:37,600
score works, what clears it, and
23
00:00:37,600 --> 00:00:38,600
whether you already have it
24
00:00:38,600 --> 00:00:39,640
turned on.
25
00:00:39,640 --> 00:00:41,679
What identity protection
actually watches.
26
00:00:41,679 --> 00:00:44,399
Start with the sign in because
that is where everything begins.
27
00:00:44,399 --> 00:00:45,759
Every time you open Teams or
28
00:00:45,759 --> 00:00:47,439
Outlook or SharePoint, you sign
29
00:00:47,439 --> 00:00:48,520
in through a service called
30
00:00:48,520 --> 00:00:50,240
Microsoft Entra ID, and that
31
00:00:50,240 --> 00:00:51,600
service is what checks who you
32
00:00:51,600 --> 00:00:52,240
are.
33
00:00:52,240 --> 00:00:53,799
For most companies, entra ID is
34
00:00:53,799 --> 00:00:55,439
the front door to email files,
35
00:00:55,439 --> 00:00:56,880
chat, and every app built on top
36
00:00:56,880 --> 00:00:58,039
of Microsoft three hundred sixty
37
00:00:58,039 --> 00:00:58,240
five.
38
00:00:58,240 --> 00:01:00,229
If you have seen the name Azure
Active Directory.
39
00:01:00,229 --> 00:01:01,670
In older training material, it's
40
00:01:01,670 --> 00:01:02,829
the same service with a newer
41
00:01:02,829 --> 00:01:03,509
label.
42
00:01:03,509 --> 00:01:05,989
Entry ID protection sits on top
of those sign ins and watches
43
00:01:05,989 --> 00:01:06,989
how they behave.
44
00:01:06,989 --> 00:01:08,510
Microsoft describes it as a way
45
00:01:08,510 --> 00:01:10,750
to detect, investigate, and fix
46
00:01:10,750 --> 00:01:12,590
identity based risks, and it can
47
00:01:12,590 --> 00:01:13,750
pass what it finds to other
48
00:01:13,750 --> 00:01:14,950
tools that make access
49
00:01:14,950 --> 00:01:15,790
decisions.
50
00:01:15,790 --> 00:01:16,950
It watches what happens after
51
00:01:16,950 --> 00:01:18,569
the sign in two, because some
52
00:01:18,569 --> 00:01:19,829
trouble only becomes visible
53
00:01:19,829 --> 00:01:20,989
once the session is already
54
00:01:20,989 --> 00:01:21,469
open.
55
00:01:21,469 --> 00:01:24,909
The score it builds from all of
this is the thread that ties the
56
00:01:24,909 --> 00:01:26,670
rest of this together.
57
00:01:26,670 --> 00:01:28,430
Attackers like identity for a
simple reason.
58
00:01:28,430 --> 00:01:31,189
Breaking into a network is hard,
and logging in with a stolen
59
00:01:31,189 --> 00:01:32,469
password is easy.
60
00:01:32,469 --> 00:01:34,870
Microsoft puts it bluntly when
it says that adversaries aren't
61
00:01:34,870 --> 00:01:36,430
breaking in, they're signing in.
62
00:01:36,430 --> 00:01:38,269
Now, here's where the scale
matters.
63
00:01:38,269 --> 00:01:39,870
Microsoft analyzes trillions of
64
00:01:39,870 --> 00:01:41,230
signals a day pulled from Active
65
00:01:41,230 --> 00:01:42,349
Directory, from Microsoft
66
00:01:42,349 --> 00:01:43,870
accounts, and even from gaming
67
00:01:43,870 --> 00:01:44,510
on Xbox.
68
00:01:44,510 --> 00:01:46,829
It also sorts through thirty
eight million identity risk
69
00:01:46,829 --> 00:01:49,750
detections every day, which is a
useful reminder that this is not
70
00:01:49,750 --> 00:01:50,790
a rare event.
71
00:01:50,790 --> 00:01:52,349
That wide net is why the system
72
00:01:52,349 --> 00:01:53,790
can tell a normal sign in from a
73
00:01:53,790 --> 00:01:55,189
strange one, because it has seen
74
00:01:55,189 --> 00:01:56,629
so many normal sign ins that it
75
00:01:56,629 --> 00:01:57,629
knows what your normal looks
76
00:01:57,629 --> 00:01:58,230
like.
77
00:01:58,230 --> 00:02:00,989
The things it flags are more
varied than you might guess.
78
00:02:00,989 --> 00:02:02,150
One is a sign in from an
79
00:02:02,150 --> 00:02:03,609
anonymous IP address, the kind
80
00:02:03,609 --> 00:02:04,709
someone uses to hide where they
81
00:02:04,709 --> 00:02:05,189
are.
82
00:02:05,189 --> 00:02:07,829
Another is a password spray
attack, where an attacker tries
83
00:02:07,829 --> 00:02:10,870
one common password across
thousands of accounts at once.
84
00:02:10,870 --> 00:02:12,270
A third is a leaked credential,
85
00:02:12,270 --> 00:02:13,629
meaning a username and password
86
00:02:13,629 --> 00:02:14,750
that already turned up in a
87
00:02:14,750 --> 00:02:15,069
breach.
88
00:02:15,069 --> 00:02:16,550
The list runs well past those.
89
00:02:16,550 --> 00:02:17,909
Hold on to this one detail.
90
00:02:17,909 --> 00:02:20,590
During every single sign in
entry ID protection runs its
91
00:02:20,590 --> 00:02:23,110
real time checks and produces a
risk level for that attempt.
92
00:02:23,110 --> 00:02:25,509
The score belongs to that one
attempt to get in, not to the
93
00:02:25,509 --> 00:02:26,189
whole day or week.
94
00:02:26,189 --> 00:02:27,550
Picture it less as a firewall,
95
00:02:27,550 --> 00:02:29,189
scanning traffic, and more as a
96
00:02:29,189 --> 00:02:30,430
system asking one human
97
00:02:30,430 --> 00:02:32,030
question, which is whether this
98
00:02:32,030 --> 00:02:33,389
sign in matches how this person
99
00:02:33,389 --> 00:02:34,710
usually behaves.
100
00:02:34,710 --> 00:02:37,069
Two kinds of risk the user and
the sign in.
101
00:02:37,069 --> 00:02:38,750
This is the part that catches
people out.
102
00:02:38,750 --> 00:02:40,270
You might think a risky login
103
00:02:40,270 --> 00:02:41,469
and a risky account are the same
104
00:02:41,469 --> 00:02:43,030
thing, but enter ID protection
105
00:02:43,030 --> 00:02:44,310
is actually asking two different
106
00:02:44,310 --> 00:02:45,990
questions, and blending them is
107
00:02:45,990 --> 00:02:46,750
easy.
108
00:02:46,750 --> 00:02:48,389
The first is sign in risk, which
109
00:02:48,389 --> 00:02:49,870
is the chance that one specific
110
00:02:49,870 --> 00:02:51,310
sign in isn't the real account
111
00:02:51,310 --> 00:02:52,030
owner.
112
00:02:52,030 --> 00:02:53,229
It's about a single moment, one
113
00:02:53,229 --> 00:02:54,590
attempt to log in and nothing
114
00:02:54,590 --> 00:02:55,229
else.
115
00:02:55,229 --> 00:02:57,740
The second is user risk, meaning
the account itself may be
116
00:02:57,740 --> 00:03:00,139
compromised, that someone has
the keys and can come back
117
00:03:00,139 --> 00:03:00,900
whenever they want.
118
00:03:00,900 --> 00:03:03,340
This one's about the person, not
about one login.
119
00:03:03,340 --> 00:03:04,360
There's a reason to keep the two
120
00:03:04,360 --> 00:03:05,419
apart and it comes down to the
121
00:03:05,419 --> 00:03:06,060
fix.
122
00:03:06,060 --> 00:03:07,479
A risky sign in is usually
123
00:03:07,479 --> 00:03:08,580
handled right there with the
124
00:03:08,580 --> 00:03:09,139
second check.
125
00:03:09,139 --> 00:03:12,020
While a risky account often
needs a password change because
126
00:03:12,020 --> 00:03:14,460
the password itself may already
be out there.
127
00:03:14,460 --> 00:03:17,060
A quick example makes the split
click if your account suddenly
128
00:03:17,060 --> 00:03:19,939
signs in from a country you have
never visited at three in the
129
00:03:19,939 --> 00:03:21,379
morning, that's sign in risk.
130
00:03:21,379 --> 00:03:24,099
If that same account also shows
up with a password that was
131
00:03:24,099 --> 00:03:26,939
found in a data breach, that's
user risk because the
132
00:03:26,939 --> 00:03:29,539
credentials themselves are in
someone else's hands.
133
00:03:29,539 --> 00:03:31,020
Microsoft ties the two together
134
00:03:31,020 --> 00:03:32,699
with one simple rule a user
135
00:03:32,699 --> 00:03:34,139
becomes a risky user when they
136
00:03:34,139 --> 00:03:35,780
have one or more risky sign ins,
137
00:03:35,780 --> 00:03:37,360
or one or more risks detected on
138
00:03:37,360 --> 00:03:38,300
their account.
139
00:03:38,300 --> 00:03:41,460
Either path lands them on the
same list that an admin can see.
140
00:03:41,460 --> 00:03:43,180
Here is a connection worth
noticing.
141
00:03:43,180 --> 00:03:44,419
A sign in risk that nobody
142
00:03:44,419 --> 00:03:45,840
clears can roll up and add to
143
00:03:45,840 --> 00:03:47,419
the user's risk, so a single odd
144
00:03:47,419 --> 00:03:48,979
login can slowly turn into a
145
00:03:48,979 --> 00:03:49,860
flagged account.
146
00:03:49,860 --> 00:03:51,099
The two measures feed each other
147
00:03:51,099 --> 00:03:52,659
in the reports, which is why a
148
00:03:52,659 --> 00:03:54,219
person can look risky even when
149
00:03:54,219 --> 00:03:55,495
the last few sign ins seemed
150
00:03:55,495 --> 00:03:56,009
fine.
151
00:03:56,009 --> 00:03:57,409
Timing matters here too, and it
152
00:03:57,409 --> 00:03:58,689
explains something that confuses
153
00:03:58,689 --> 00:03:59,169
people.
154
00:03:59,169 --> 00:04:01,810
Some checks run while the sign
in is happening, and the details
155
00:04:01,810 --> 00:04:04,009
appear in the reports within
five to ten minutes.
156
00:04:04,009 --> 00:04:06,430
Other checks run after the fact,
and they can take up to forty
157
00:04:06,430 --> 00:04:07,569
eight hours to show up.
158
00:04:07,569 --> 00:04:08,849
Those slower checks look at the
159
00:04:08,849 --> 00:04:10,250
bigger picture, which is why a
160
00:04:10,250 --> 00:04:11,770
risk level can change a day
161
00:04:11,770 --> 00:04:12,770
later.
162
00:04:12,770 --> 00:04:14,610
What the risk levels mean once
163
00:04:14,610 --> 00:04:15,849
the checks run, they produce a
164
00:04:15,849 --> 00:04:17,529
score and that score comes in
165
00:04:17,529 --> 00:04:19,769
three levels low, medium and
166
00:04:19,769 --> 00:04:20,209
high.
167
00:04:20,209 --> 00:04:21,209
That's the whole scale.
168
00:04:21,209 --> 00:04:22,930
The plain English version goes
like this.
169
00:04:22,930 --> 00:04:25,490
High risk means Microsoft is
highly confident that the
170
00:04:25,490 --> 00:04:26,769
account is compromised.
171
00:04:26,769 --> 00:04:29,569
Medium risk means there are
moderate signs of trouble, but
172
00:04:29,569 --> 00:04:31,889
less confidence that someone
else is really in there.
173
00:04:31,889 --> 00:04:33,170
Low risk means something looked
174
00:04:33,170 --> 00:04:34,850
off and the confidence is lower
175
00:04:34,850 --> 00:04:35,370
still.
176
00:04:35,370 --> 00:04:37,790
Those levels come from machine
learning that estimates how
177
00:04:37,790 --> 00:04:40,209
likely it is that a person's
credentials are known to someone
178
00:04:40,209 --> 00:04:41,290
who shouldn't have them.
179
00:04:41,290 --> 00:04:42,569
Along with the level, Microsoft
180
00:04:42,569 --> 00:04:43,889
keeps a risk detail, which is
181
00:04:43,889 --> 00:04:45,089
the plain language reason behind
182
00:04:45,089 --> 00:04:45,810
the score.
183
00:04:45,810 --> 00:04:47,129
It lets an admin see whether the
184
00:04:47,129 --> 00:04:48,370
risk came from a leaked
185
00:04:48,370 --> 00:04:50,009
password, a spray attack or
186
00:04:50,009 --> 00:04:51,250
something the person reported
187
00:04:51,250 --> 00:04:52,050
themselves.
188
00:04:52,050 --> 00:04:53,649
Not every detection sits at one
189
00:04:53,649 --> 00:04:55,759
fixed level unfamiliar sign in
190
00:04:55,759 --> 00:04:56,920
properties, for example, can
191
00:04:56,920 --> 00:04:58,860
fire at high, medium, or low,
192
00:04:58,860 --> 00:05:00,480
depending on how unusual that
193
00:05:00,480 --> 00:05:01,480
sign in looks next to the
194
00:05:01,480 --> 00:05:02,639
person's history.
195
00:05:02,639 --> 00:05:04,680
The stranger it looks, the
higher it climbs.
196
00:05:04,680 --> 00:05:05,920
Some detections are always high
197
00:05:05,920 --> 00:05:07,699
because Microsoft isn't guessing
198
00:05:07,699 --> 00:05:09,079
leaked credentials and a
199
00:05:09,079 --> 00:05:10,800
verified threat actor IP both
200
00:05:10,800 --> 00:05:12,319
land at high risk because in
201
00:05:12,319 --> 00:05:13,399
those cases, there's real proof
202
00:05:13,399 --> 00:05:14,839
that something was exposed or
203
00:05:14,839 --> 00:05:15,680
that a known attacker is
204
00:05:15,680 --> 00:05:16,120
involved.
205
00:05:16,120 --> 00:05:17,199
There's one more detail that
206
00:05:17,199 --> 00:05:18,319
rarely makes it into beginner
207
00:05:18,319 --> 00:05:20,000
explanations, and it matters for
208
00:05:20,000 --> 00:05:21,160
expectations.
209
00:05:21,160 --> 00:05:23,759
Low risk items age out on their
own after about six months,
210
00:05:23,759 --> 00:05:26,199
which keeps the report clean,
medium and high risk.
211
00:05:26,199 --> 00:05:27,360
Don't age out and they sit there
212
00:05:27,360 --> 00:05:28,560
until someone fixes them or
213
00:05:28,560 --> 00:05:29,680
dismisses them.
214
00:05:29,680 --> 00:05:30,959
A level is really a confidence
215
00:05:30,959 --> 00:05:32,339
reading, which means a low score
216
00:05:32,339 --> 00:05:33,879
can still be worth a look, and a
217
00:05:33,879 --> 00:05:35,480
high score can occasionally be a
218
00:05:35,480 --> 00:05:36,639
false alarm that an admin
219
00:05:36,639 --> 00:05:37,360
clears.
220
00:05:37,360 --> 00:05:38,319
The level matters for two
221
00:05:38,319 --> 00:05:39,439
reasons at once, because it
222
00:05:39,439 --> 00:05:40,759
decides how urgently a person
223
00:05:40,759 --> 00:05:42,480
should look and how strict the
224
00:05:42,480 --> 00:05:44,000
automatic response is allowed to
225
00:05:44,000 --> 00:05:44,800
be.
226
00:05:44,800 --> 00:05:46,879
How risk turns into a decision.
227
00:05:46,879 --> 00:05:48,279
A score on its own does nothing.
228
00:05:48,279 --> 00:05:49,759
It has to turn into a decision.
229
00:05:49,759 --> 00:05:52,040
And that decision is where the
whole concept pays off.
230
00:05:52,040 --> 00:05:54,360
The score gets handed to
Microsoft Entra conditional
231
00:05:54,360 --> 00:05:56,079
access if that name is new.
232
00:05:56,079 --> 00:05:58,560
Think of conditional access as a
set of.
233
00:05:58,560 --> 00:06:00,920
If this, then that rules for
signing in.
234
00:06:00,920 --> 00:06:03,279
When a condition is true, a rule
fires.
235
00:06:03,279 --> 00:06:04,839
Two of those conditions come
straight from.
236
00:06:04,839 --> 00:06:08,120
Enter ID protection and their
sign in risk and user risk
237
00:06:08,120 --> 00:06:10,480
during every sign in the
protection layer sends the
238
00:06:10,480 --> 00:06:13,319
detected levels over and the
rules get evaluated.
239
00:06:13,319 --> 00:06:14,459
Each policy can be set to
240
00:06:14,459 --> 00:06:16,319
trigger at low, medium, high or
241
00:06:16,319 --> 00:06:17,639
no risk detected, so an
242
00:06:17,639 --> 00:06:18,680
organization tunes the
243
00:06:18,680 --> 00:06:19,959
strictness to its own comfort
244
00:06:19,959 --> 00:06:20,720
level.
245
00:06:20,720 --> 00:06:23,360
A cautious company might
challenge a medium risk sign in,
246
00:06:23,360 --> 00:06:26,199
while a more relaxed one waits
for high from the person's side,
247
00:06:26,199 --> 00:06:27,519
it looks like a normal prompt.
248
00:06:27,519 --> 00:06:28,560
They don't get a security
249
00:06:28,560 --> 00:06:29,680
lecture, they just have to prove
250
00:06:29,680 --> 00:06:30,240
it's them.
251
00:06:30,240 --> 00:06:32,439
For sign in risk, the choices
are easy to follow.
252
00:06:32,439 --> 00:06:35,120
The rule can block the sign in,
allow it require multifactor
253
00:06:35,120 --> 00:06:37,560
authentication, or require the
person to sign in again.
254
00:06:37,560 --> 00:06:38,759
If the person completes the
255
00:06:38,759 --> 00:06:40,519
required step, like a prompt on
256
00:06:40,519 --> 00:06:42,160
their phone, the risk clears on
257
00:06:42,160 --> 00:06:42,759
the spot.
258
00:06:42,759 --> 00:06:44,040
For user risk, the choices are
259
00:06:44,040 --> 00:06:45,199
require risk remediation,
260
00:06:45,199 --> 00:06:46,600
require a password change, or
261
00:06:46,600 --> 00:06:47,319
block access.
262
00:06:47,319 --> 00:06:48,519
Those three aim at a different
263
00:06:48,519 --> 00:06:50,079
problem because user risk means
264
00:06:50,079 --> 00:06:51,399
the account itself may be in the
265
00:06:51,399 --> 00:06:52,069
wrong hands.
266
00:06:52,069 --> 00:06:53,470
The middle option require risk
267
00:06:53,470 --> 00:06:55,069
remediation is the clever one,
268
00:06:55,069 --> 00:06:56,029
and it deserves a plain
269
00:06:56,029 --> 00:06:57,029
explanation.
270
00:06:57,029 --> 00:06:58,750
It adapts to how the person
signs in.
271
00:06:58,750 --> 00:07:00,149
If they use a password, it asks
272
00:07:00,149 --> 00:07:01,790
for a secure password change and
273
00:07:01,790 --> 00:07:02,790
then cuts off their old
274
00:07:02,790 --> 00:07:03,189
sessions.
275
00:07:03,189 --> 00:07:04,230
If they sign in without a
276
00:07:04,230 --> 00:07:05,189
password, it cuts off the
277
00:07:05,189 --> 00:07:06,470
sessions and asks them to sign
278
00:07:06,470 --> 00:07:07,269
in again.
279
00:07:07,269 --> 00:07:09,550
One policy different fix chosen
automatically.
280
00:07:09,550 --> 00:07:10,790
This is where automation earns
281
00:07:10,790 --> 00:07:12,629
its keep at the scale Microsoft
282
00:07:12,629 --> 00:07:13,110
operates.
283
00:07:13,110 --> 00:07:16,269
No team could review every sign
in by hand, so the rules handle
284
00:07:16,269 --> 00:07:18,990
the common cases and leave only
the strange ones for a person.
285
00:07:18,990 --> 00:07:20,029
There's a rule about stacking
286
00:07:20,029 --> 00:07:21,350
these that keeps admins out of
287
00:07:21,350 --> 00:07:21,910
trouble.
288
00:07:21,910 --> 00:07:23,149
Risk remediation beats a
289
00:07:23,149 --> 00:07:24,670
password change and block beats
290
00:07:24,670 --> 00:07:25,470
everything else.
291
00:07:25,470 --> 00:07:28,389
Don't pile several of these onto
the same person because only the
292
00:07:28,389 --> 00:07:30,629
strongest one wins and the rest
go to waste.
293
00:07:30,629 --> 00:07:32,629
One honest limitation is worth
knowing.
294
00:07:32,629 --> 00:07:33,990
The full risk remediation flow
295
00:07:33,990 --> 00:07:35,189
doesn't work for guests and
296
00:07:35,189 --> 00:07:36,470
external users, because
297
00:07:36,470 --> 00:07:37,709
Microsoft doesn't revoke
298
00:07:37,709 --> 00:07:38,949
sessions for those accounts the
299
00:07:38,949 --> 00:07:40,870
same way how people fix it
300
00:07:40,870 --> 00:07:41,589
themselves.
301
00:07:41,589 --> 00:07:43,709
Now we get to the part beginners
like best.
302
00:07:43,709 --> 00:07:45,209
Most of the time, nobody from it
303
00:07:45,209 --> 00:07:46,470
has to get involved because the
304
00:07:46,470 --> 00:07:47,709
person clears the risk on their
305
00:07:47,709 --> 00:07:48,149
own.
306
00:07:48,149 --> 00:07:50,704
Microsoft calls the self
remediation, and it's exactly as
307
00:07:50,704 --> 00:07:51,459
simple as it sounds.
308
00:07:51,459 --> 00:07:52,819
If it's sign in risk, the person
309
00:07:52,819 --> 00:07:54,259
gets prompted for multi-factor
310
00:07:54,259 --> 00:07:55,060
authentication.
311
00:07:55,060 --> 00:07:56,779
That's the second proof we keep
coming back to.
312
00:07:56,779 --> 00:07:58,939
Usually a code or an approval on
a phone.
313
00:07:58,939 --> 00:08:02,000
Once they pass it, the risk
state flips from at risk to
314
00:08:02,000 --> 00:08:04,500
remediated, and they carry on
with their day.
315
00:08:04,500 --> 00:08:06,259
If it's user risk and the policy
316
00:08:06,259 --> 00:08:07,459
asks for a password change, the
317
00:08:07,459 --> 00:08:08,779
person completes multi-factor
318
00:08:08,779 --> 00:08:10,339
authentication and then sets a
319
00:08:10,339 --> 00:08:11,259
new password.
320
00:08:11,259 --> 00:08:14,540
The risk clears and their old
sessions get cut off, so anyone
321
00:08:14,540 --> 00:08:16,459
holding the old password is
locked out, too.
322
00:08:16,459 --> 00:08:19,060
There's one honest nuance here
because people mix these two up.
323
00:08:19,060 --> 00:08:21,740
This is a secure password change
where the person still knows
324
00:08:21,740 --> 00:08:24,019
their current password and
simply replaces it.
325
00:08:24,019 --> 00:08:26,860
It isn't the same as a forgotten
password reset, and it only
326
00:08:26,860 --> 00:08:29,180
works if the person already
registered a second factor,
327
00:08:29,180 --> 00:08:32,299
which is why setting that up
ahead of time matters so much.
328
00:08:32,299 --> 00:08:35,460
Sometimes the system clears the
risk all by itself if the person
329
00:08:35,460 --> 00:08:38,580
provides a second factor, or if
a later check decides the sign
330
00:08:38,580 --> 00:08:41,299
in is no longer risky, the risk
gets dismissed automatically and
331
00:08:41,299 --> 00:08:42,580
stops counting against them.
332
00:08:42,580 --> 00:08:44,779
When it can't be cleared, an
admin steps in.
333
00:08:44,779 --> 00:08:45,899
They can issue a temporary
334
00:08:45,899 --> 00:08:47,460
password, require a password
335
00:08:47,460 --> 00:08:48,700
change, dismiss the risk,
336
00:08:48,700 --> 00:08:49,929
confirm that the account is
337
00:08:49,929 --> 00:08:51,210
compromised or unblocked the
338
00:08:51,210 --> 00:08:51,769
person.
339
00:08:51,769 --> 00:08:52,970
A temporary password brings the
340
00:08:52,970 --> 00:08:54,250
account back to a safe state
341
00:08:54,250 --> 00:08:55,610
right away, with the catch that
342
00:08:55,610 --> 00:08:56,970
the person has to be told what
343
00:08:56,970 --> 00:08:57,570
it is.
344
00:08:57,570 --> 00:08:59,289
Hybrid users aren't left out
either.
345
00:08:59,289 --> 00:09:01,649
If your organization keeps
accounts on an on premises
346
00:09:01,649 --> 00:09:04,809
server as well as in the cloud,
one more setting matters with
347
00:09:04,809 --> 00:09:07,809
password hash synchronization
switched on, a password change
348
00:09:07,809 --> 00:09:10,330
made on a company device can
clear the user's risk to.
349
00:09:10,330 --> 00:09:11,289
The whole point of this design
350
00:09:11,289 --> 00:09:12,590
is to take load off the help
351
00:09:12,590 --> 00:09:13,009
desk.
352
00:09:13,009 --> 00:09:14,129
A person who can fix their own
353
00:09:14,129 --> 00:09:15,730
risk is one fewer ticket and one
354
00:09:15,730 --> 00:09:16,610
faster fix.
355
00:09:16,610 --> 00:09:18,809
There's also a safety net
underneath all of this.
356
00:09:18,809 --> 00:09:20,330
Microsoft automatically blocks
357
00:09:20,330 --> 00:09:21,610
sign ins that carry very high
358
00:09:21,610 --> 00:09:23,289
confidence of being risky, most
359
00:09:23,289 --> 00:09:24,730
often from old style sign in
360
00:09:24,730 --> 00:09:26,090
methods that skip modern
361
00:09:26,090 --> 00:09:26,929
protections.
362
00:09:26,929 --> 00:09:29,970
That's one more reason to move
away from those older methods.
363
00:09:29,970 --> 00:09:32,809
What the admin actually sees
when something can't be cleared
364
00:09:32,809 --> 00:09:35,610
automatically, it lands in front
of a human and the reports are
365
00:09:35,610 --> 00:09:36,490
built for that moment.
366
00:09:36,490 --> 00:09:37,730
There are three main reports.
367
00:09:37,730 --> 00:09:39,070
Risk detection shows each
368
00:09:39,070 --> 00:09:40,250
individual thing that was
369
00:09:40,250 --> 00:09:40,850
noticed.
370
00:09:40,850 --> 00:09:42,330
Risky sign ins shows sign ins
371
00:09:42,330 --> 00:09:43,450
that carry one or more of those
372
00:09:43,450 --> 00:09:44,169
detections.
373
00:09:44,169 --> 00:09:46,129
Risky users shows the accounts
374
00:09:46,129 --> 00:09:47,610
because a user gets flagged when
375
00:09:47,610 --> 00:09:48,970
they have a risky sign in or a
376
00:09:48,970 --> 00:09:50,490
detection on their account, and
377
00:09:50,490 --> 00:09:51,690
admin starts by looking at the
378
00:09:51,690 --> 00:09:53,210
dashboard and the reports, then
379
00:09:53,210 --> 00:09:54,570
checks the sign in logs for
380
00:09:54,570 --> 00:09:55,610
other accounts with the same
381
00:09:55,610 --> 00:09:56,169
fingerprint.
382
00:09:56,169 --> 00:09:59,230
If five accounts all failed from
the same IP address in the same
383
00:09:59,230 --> 00:10:02,649
hour, that pattern matters far
more than any single event.
384
00:10:02,649 --> 00:10:05,049
Then comes the judgment call at
the center of the whole job,
385
00:10:05,049 --> 00:10:07,090
which is deciding whether the
alert is real.
386
00:10:07,090 --> 00:10:08,509
An admin can confirm a sign in
387
00:10:08,509 --> 00:10:10,129
is compromised, confirm it as
388
00:10:10,129 --> 00:10:11,690
safe, or dismiss it as a true
389
00:10:11,690 --> 00:10:12,970
positive that turned out
390
00:10:12,970 --> 00:10:13,610
harmless.
391
00:10:13,610 --> 00:10:16,570
The difference between those
last two is small but real.
392
00:10:16,570 --> 00:10:19,250
Confirming safe tells the system
this was a false alarm.
393
00:10:19,250 --> 00:10:21,809
While dismissing says the alert
was real but harmless.
394
00:10:21,809 --> 00:10:23,210
The way a planned security test
395
00:10:23,210 --> 00:10:24,570
looks suspicious without being
396
00:10:24,570 --> 00:10:26,049
an attack.
397
00:10:26,049 --> 00:10:28,129
The details pane is where the
story fills in.
398
00:10:28,129 --> 00:10:29,610
It shows the app the person was
399
00:10:29,610 --> 00:10:31,049
reaching for the device, the
400
00:10:31,049 --> 00:10:32,730
location, and the IP address,
401
00:10:32,730 --> 00:10:33,789
which is usually enough to
402
00:10:33,789 --> 00:10:35,090
separate a real attack from a
403
00:10:35,090 --> 00:10:35,970
false alarm.
404
00:10:35,970 --> 00:10:37,370
For bigger teams, the reports
405
00:10:37,370 --> 00:10:38,769
can be exported or read through
406
00:10:38,769 --> 00:10:40,809
an API so the data can flow into
407
00:10:40,809 --> 00:10:42,049
a security tool the company
408
00:10:42,049 --> 00:10:42,889
already uses.
409
00:10:42,889 --> 00:10:45,809
If an admin confirms that an
account is compromised, there's
410
00:10:45,809 --> 00:10:47,080
a short list of moves.
411
00:10:47,080 --> 00:10:48,159
Reset the password.
412
00:10:48,159 --> 00:10:49,080
Block the account.
413
00:10:49,080 --> 00:10:50,519
Revoke the tokens that keep the
414
00:10:50,519 --> 00:10:52,120
session alive, and disable a
415
00:10:52,120 --> 00:10:53,200
compromised device.
416
00:10:53,200 --> 00:10:54,720
Revoking sessions is the step
417
00:10:54,720 --> 00:10:56,039
people forget, and it's often
418
00:10:56,039 --> 00:10:57,320
the one that actually pushes an
419
00:10:57,320 --> 00:10:58,240
attacker out.
420
00:10:58,240 --> 00:10:59,120
The reports don't keep
421
00:10:59,120 --> 00:11:00,120
everything forever, so
422
00:11:00,120 --> 00:11:01,779
expectations should match risky
423
00:11:01,779 --> 00:11:02,200
sign ins.
424
00:11:02,200 --> 00:11:05,120
Go back thirty days and risk
detections go back ninety days.
425
00:11:05,120 --> 00:11:08,159
This is also a controlled job,
not a free for all.
426
00:11:08,159 --> 00:11:10,159
A security reader can look
without changing anything.
427
00:11:10,159 --> 00:11:12,960
A security operator can act on
risks and changing the policies.
428
00:11:12,960 --> 00:11:14,159
Needs a security administrator
429
00:11:14,159 --> 00:11:15,039
or a conditional access
430
00:11:15,039 --> 00:11:16,159
administrator.
431
00:11:16,159 --> 00:11:17,679
What it costs and what you need
432
00:11:17,679 --> 00:11:18,679
before any of this matters to
433
00:11:18,679 --> 00:11:18,799
you.
434
00:11:18,799 --> 00:11:21,120
There's one practical question
to settle, which is whether you
435
00:11:21,120 --> 00:11:21,720
actually have it.
436
00:11:21,720 --> 00:11:23,000
Now for the practical part.
437
00:11:23,000 --> 00:11:26,019
Full entry ID protection needs a
license called Microsoft entry
438
00:11:26,019 --> 00:11:26,720
ID P two.
439
00:11:26,720 --> 00:11:28,120
And that single requirement is
440
00:11:28,120 --> 00:11:29,639
what trips people up without P
441
00:11:29,639 --> 00:11:29,960
two.
442
00:11:29,960 --> 00:11:31,360
You aren't completely blind, but
443
00:11:31,360 --> 00:11:32,840
you're limited in the free and
444
00:11:32,840 --> 00:11:33,519
P1 versions.
445
00:11:33,519 --> 00:11:36,320
Only medium and high risk users
even show up, and there's no
446
00:11:36,320 --> 00:11:38,600
details panel and no risk
history to dig through.
447
00:11:38,600 --> 00:11:41,440
You also can't turn the risk
policies on at all, and
448
00:11:41,440 --> 00:11:44,559
detections show up as a vague
additional risk detected with no
449
00:11:44,559 --> 00:11:45,750
detail behind them.
450
00:11:45,750 --> 00:11:46,809
So here's the sentence to
451
00:11:46,809 --> 00:11:47,929
remember about the two paid
452
00:11:47,929 --> 00:11:48,590
tiers.
453
00:11:48,590 --> 00:11:51,710
Conditional access itself comes
with P1, but the risk based
454
00:11:51,710 --> 00:11:53,269
version of it needs P2.
455
00:11:53,269 --> 00:11:55,549
That single distinction explains
most of the confusion.
456
00:11:55,549 --> 00:11:56,789
P1 does give you conditional
457
00:11:56,789 --> 00:11:57,710
access and multi-factor
458
00:11:57,710 --> 00:11:59,230
authentication, but it doesn't
459
00:11:59,230 --> 00:12:00,190
give you the risk engine
460
00:12:00,190 --> 00:12:01,710
underneath them, and that engine
461
00:12:01,710 --> 00:12:02,710
is the reason the feature
462
00:12:02,710 --> 00:12:03,429
exists.
463
00:12:03,429 --> 00:12:05,789
The good news is that plenty of
workplaces already have this,
464
00:12:05,789 --> 00:12:07,389
and nobody realizes.
465
00:12:07,389 --> 00:12:09,269
Entry ID two ships with
Microsoft three.
466
00:12:09,269 --> 00:12:12,470
Sixty five E5 The Microsoft
Defender Suite Enterprise
467
00:12:12,470 --> 00:12:15,830
Mobility Plus Security E5, and
the entry suite, which folds in
468
00:12:15,830 --> 00:12:17,830
several other identity products
along with it.
469
00:12:17,830 --> 00:12:19,870
The lighter tier entry ID, P1
470
00:12:19,870 --> 00:12:20,870
ships with Microsoft three
471
00:12:20,870 --> 00:12:22,149
hundred sixty five, E3, and
472
00:12:22,149 --> 00:12:23,110
Business Premium.
473
00:12:23,110 --> 00:12:25,710
If your company runs on one of
those plans, the feature may
474
00:12:25,710 --> 00:12:28,070
already be sitting there, paid
for, and switched off.
475
00:12:28,070 --> 00:12:29,990
There's one caveat about
detections.
476
00:12:29,990 --> 00:12:31,070
Some of them come from other
477
00:12:31,070 --> 00:12:32,669
Microsoft Defender products, so
478
00:12:32,669 --> 00:12:33,909
those specific signals only
479
00:12:33,909 --> 00:12:35,029
appear if you also have the
480
00:12:35,029 --> 00:12:36,110
matching license.
481
00:12:36,110 --> 00:12:38,590
An empty report doesn't always
mean everything is fine.
482
00:12:38,590 --> 00:12:40,750
There's also a note for the
future facing crowd.
483
00:12:40,750 --> 00:12:44,679
The newer reporting covers risky
agents, too, because AI agents
484
00:12:44,679 --> 00:12:48,419
now sign in and hold access,
just like people do.
485
00:12:48,419 --> 00:12:50,220
Best practices that actually
matter.
486
00:12:50,220 --> 00:12:51,659
If you take only a handful of
487
00:12:51,659 --> 00:12:53,419
setup steps away from this, make
488
00:12:53,419 --> 00:12:54,059
them these.
489
00:12:54,059 --> 00:12:56,139
The one that prevents disaster
comes first.
490
00:12:56,139 --> 00:12:59,299
Exclude your emergency accounts
and keep a break glass account
491
00:12:59,299 --> 00:13:01,019
that these policies never touch.
492
00:13:01,019 --> 00:13:02,820
So a misconfiguration can't lock
493
00:13:02,820 --> 00:13:03,899
everyone out of the building at
494
00:13:03,899 --> 00:13:04,580
once.
495
00:13:04,580 --> 00:13:06,539
Service accounts deserve the
same care.
496
00:13:06,539 --> 00:13:09,340
Next, get people registered for
multi-factor authentication
497
00:13:09,340 --> 00:13:10,299
before they need it.
498
00:13:10,299 --> 00:13:13,179
Self remediation depends on the
person already having a second
499
00:13:13,179 --> 00:13:14,179
factor set up.
500
00:13:14,179 --> 00:13:17,139
So the MFA registration policy
isn't optional.
501
00:13:17,139 --> 00:13:19,139
It's the foundation everything
else stands on.
502
00:13:19,139 --> 00:13:20,980
Then mark your trusted
locations.
503
00:13:20,980 --> 00:13:22,100
When you tell the system which
504
00:13:22,100 --> 00:13:23,700
networks and VPN ranges are
505
00:13:23,700 --> 00:13:25,419
known and safe, sign ins from
506
00:13:25,419 --> 00:13:26,740
those places lower a person's
507
00:13:26,740 --> 00:13:27,980
risk and cut down on false
508
00:13:27,980 --> 00:13:28,779
alarms.
509
00:13:28,779 --> 00:13:29,659
That step isn't just a
510
00:13:29,659 --> 00:13:30,940
convenience either, because it
511
00:13:30,940 --> 00:13:32,100
teaches the system what a safe
512
00:13:32,100 --> 00:13:33,340
signing looks like and sharpens
513
00:13:33,340 --> 00:13:34,340
every judgment it makes
514
00:13:34,340 --> 00:13:34,779
afterward.
515
00:13:34,779 --> 00:13:37,700
Before you enforce anything, use
report only mode.
516
00:13:37,700 --> 00:13:40,100
It shows you exactly what a
policy would have done before
517
00:13:40,100 --> 00:13:42,299
you switch it on and start
blocking real people.
518
00:13:42,299 --> 00:13:44,019
When you do enforce, start
small.
519
00:13:44,019 --> 00:13:45,580
Scope a new policy to a test
group.
520
00:13:45,580 --> 00:13:46,899
Watch how it behaves for a week
521
00:13:46,899 --> 00:13:48,220
and widen it out once you trust
522
00:13:48,220 --> 00:13:48,620
it.
523
00:13:48,620 --> 00:13:52,419
Turn on the notifications to ask
for an alert when a user gets
524
00:13:52,419 --> 00:13:53,899
flagged and a weekly digest.
525
00:13:53,899 --> 00:13:56,659
So risk doesn't sit unseen in a
report and nobody opens.
526
00:13:56,659 --> 00:13:59,139
And before any of that review
the existing reports.
527
00:13:59,139 --> 00:14:00,340
If there are already flagged
528
00:14:00,340 --> 00:14:02,139
users, you want to know that
529
00:14:02,139 --> 00:14:03,539
before you turn on enforcement
530
00:14:03,539 --> 00:14:04,860
and then wonder why half the
531
00:14:04,860 --> 00:14:06,440
company is being blocked, if you
532
00:14:06,440 --> 00:14:07,840
can simulate a threat during
533
00:14:07,840 --> 00:14:09,139
testing so your team has
534
00:14:09,139 --> 00:14:10,419
practiced the response before it
535
00:14:10,419 --> 00:14:11,419
counts.
536
00:14:11,419 --> 00:14:13,100
A quick recap and one question.
537
00:14:13,100 --> 00:14:14,379
So let's bring it together.
538
00:14:14,379 --> 00:14:16,740
Enter ID protection which is how
people sign in.
539
00:14:16,740 --> 00:14:20,220
It scores user risk and sign in
risk as low, medium or high.
540
00:14:20,220 --> 00:14:21,240
It hands that score to
541
00:14:21,240 --> 00:14:22,299
conditional access, which
542
00:14:22,299 --> 00:14:23,580
decides whether to allow the
543
00:14:23,580 --> 00:14:25,019
sign in, block it, or ask for
544
00:14:25,019 --> 00:14:25,740
proof.
545
00:14:25,740 --> 00:14:28,340
In most cases, people clear the
risk themselves with a second
546
00:14:28,340 --> 00:14:31,200
check or a secure password
change, and anything left over
547
00:14:31,200 --> 00:14:33,539
goes to an admin who
investigates and acts.
548
00:14:33,539 --> 00:14:35,100
Here's the question I'll leave
you with.
549
00:14:35,100 --> 00:14:36,460
If a stolen password is the most
550
00:14:36,460 --> 00:14:37,980
common way in, and the second
551
00:14:37,980 --> 00:14:39,480
check stops nearly all of it,
552
00:14:39,480 --> 00:14:40,700
why is a password on its own
553
00:14:40,700 --> 00:14:42,019
still the default in so many
554
00:14:42,019 --> 00:14:42,820
places?
00:00:00,040 --> 00:00:03,919
Welcome to the M365 FM podcast,
where we explore the people,
2
00:00:03,919 --> 00:00:07,080
ideas and technologies shaping
the future of work.
3
00:00:07,080 --> 00:00:08,560
Microsoft says more than ninety
4
00:00:08,560 --> 00:00:09,640
seven percent of identity
5
00:00:09,640 --> 00:00:10,800
attacks are just password
6
00:00:10,800 --> 00:00:11,480
attacks.
7
00:00:11,480 --> 00:00:12,880
The usual way into a Microsoft
8
00:00:12,880 --> 00:00:14,039
three hundred sixty five account
9
00:00:14,039 --> 00:00:15,160
is a password that leaked
10
00:00:15,160 --> 00:00:15,880
somewhere else.
11
00:00:15,880 --> 00:00:16,920
Not a clever hack.
12
00:00:16,920 --> 00:00:18,879
Microsoft Enter ID protection is
13
00:00:18,879 --> 00:00:20,039
the part of Microsoft's cloud
14
00:00:20,039 --> 00:00:21,359
that watches those sign ins and
15
00:00:21,359 --> 00:00:22,679
flags the accounts that look
16
00:00:22,679 --> 00:00:23,239
stolen.
17
00:00:23,239 --> 00:00:27,440
Welcome to the M365 FM podcast,
where we explore the people,
18
00:00:27,440 --> 00:00:30,239
ideas and technologies shaping
the future of work.
19
00:00:30,239 --> 00:00:32,759
It doesn't lock everyone out
because it scores the risk and
20
00:00:32,759 --> 00:00:34,759
then asks the person to prove
it's really them.
21
00:00:34,759 --> 00:00:36,119
By the end, you'll know how that
22
00:00:36,119 --> 00:00:37,600
score works, what clears it, and
23
00:00:37,600 --> 00:00:38,600
whether you already have it
24
00:00:38,600 --> 00:00:39,640
turned on.
25
00:00:39,640 --> 00:00:41,679
What identity protection
actually watches.
26
00:00:41,679 --> 00:00:44,399
Start with the sign in because
that is where everything begins.
27
00:00:44,399 --> 00:00:45,759
Every time you open Teams or
28
00:00:45,759 --> 00:00:47,439
Outlook or SharePoint, you sign
29
00:00:47,439 --> 00:00:48,520
in through a service called
30
00:00:48,520 --> 00:00:50,240
Microsoft Entra ID, and that
31
00:00:50,240 --> 00:00:51,600
service is what checks who you
32
00:00:51,600 --> 00:00:52,240
are.
33
00:00:52,240 --> 00:00:53,799
For most companies, entra ID is
34
00:00:53,799 --> 00:00:55,439
the front door to email files,
35
00:00:55,439 --> 00:00:56,880
chat, and every app built on top
36
00:00:56,880 --> 00:00:58,039
of Microsoft three hundred sixty
37
00:00:58,039 --> 00:00:58,240
five.
38
00:00:58,240 --> 00:01:00,229
If you have seen the name Azure
Active Directory.
39
00:01:00,229 --> 00:01:01,670
In older training material, it's
40
00:01:01,670 --> 00:01:02,829
the same service with a newer
41
00:01:02,829 --> 00:01:03,509
label.
42
00:01:03,509 --> 00:01:05,989
Entry ID protection sits on top
of those sign ins and watches
43
00:01:05,989 --> 00:01:06,989
how they behave.
44
00:01:06,989 --> 00:01:08,510
Microsoft describes it as a way
45
00:01:08,510 --> 00:01:10,750
to detect, investigate, and fix
46
00:01:10,750 --> 00:01:12,590
identity based risks, and it can
47
00:01:12,590 --> 00:01:13,750
pass what it finds to other
48
00:01:13,750 --> 00:01:14,950
tools that make access
49
00:01:14,950 --> 00:01:15,790
decisions.
50
00:01:15,790 --> 00:01:16,950
It watches what happens after
51
00:01:16,950 --> 00:01:18,569
the sign in two, because some
52
00:01:18,569 --> 00:01:19,829
trouble only becomes visible
53
00:01:19,829 --> 00:01:20,989
once the session is already
54
00:01:20,989 --> 00:01:21,469
open.
55
00:01:21,469 --> 00:01:24,909
The score it builds from all of
this is the thread that ties the
56
00:01:24,909 --> 00:01:26,670
rest of this together.
57
00:01:26,670 --> 00:01:28,430
Attackers like identity for a
simple reason.
58
00:01:28,430 --> 00:01:31,189
Breaking into a network is hard,
and logging in with a stolen
59
00:01:31,189 --> 00:01:32,469
password is easy.
60
00:01:32,469 --> 00:01:34,870
Microsoft puts it bluntly when
it says that adversaries aren't
61
00:01:34,870 --> 00:01:36,430
breaking in, they're signing in.
62
00:01:36,430 --> 00:01:38,269
Now, here's where the scale
matters.
63
00:01:38,269 --> 00:01:39,870
Microsoft analyzes trillions of
64
00:01:39,870 --> 00:01:41,230
signals a day pulled from Active
65
00:01:41,230 --> 00:01:42,349
Directory, from Microsoft
66
00:01:42,349 --> 00:01:43,870
accounts, and even from gaming
67
00:01:43,870 --> 00:01:44,510
on Xbox.
68
00:01:44,510 --> 00:01:46,829
It also sorts through thirty
eight million identity risk
69
00:01:46,829 --> 00:01:49,750
detections every day, which is a
useful reminder that this is not
70
00:01:49,750 --> 00:01:50,790
a rare event.
71
00:01:50,790 --> 00:01:52,349
That wide net is why the system
72
00:01:52,349 --> 00:01:53,790
can tell a normal sign in from a
73
00:01:53,790 --> 00:01:55,189
strange one, because it has seen
74
00:01:55,189 --> 00:01:56,629
so many normal sign ins that it
75
00:01:56,629 --> 00:01:57,629
knows what your normal looks
76
00:01:57,629 --> 00:01:58,230
like.
77
00:01:58,230 --> 00:02:00,989
The things it flags are more
varied than you might guess.
78
00:02:00,989 --> 00:02:02,150
One is a sign in from an
79
00:02:02,150 --> 00:02:03,609
anonymous IP address, the kind
80
00:02:03,609 --> 00:02:04,709
someone uses to hide where they
81
00:02:04,709 --> 00:02:05,189
are.
82
00:02:05,189 --> 00:02:07,829
Another is a password spray
attack, where an attacker tries
83
00:02:07,829 --> 00:02:10,870
one common password across
thousands of accounts at once.
84
00:02:10,870 --> 00:02:12,270
A third is a leaked credential,
85
00:02:12,270 --> 00:02:13,629
meaning a username and password
86
00:02:13,629 --> 00:02:14,750
that already turned up in a
87
00:02:14,750 --> 00:02:15,069
breach.
88
00:02:15,069 --> 00:02:16,550
The list runs well past those.
89
00:02:16,550 --> 00:02:17,909
Hold on to this one detail.
90
00:02:17,909 --> 00:02:20,590
During every single sign in
entry ID protection runs its
91
00:02:20,590 --> 00:02:23,110
real time checks and produces a
risk level for that attempt.
92
00:02:23,110 --> 00:02:25,509
The score belongs to that one
attempt to get in, not to the
93
00:02:25,509 --> 00:02:26,189
whole day or week.
94
00:02:26,189 --> 00:02:27,550
Picture it less as a firewall,
95
00:02:27,550 --> 00:02:29,189
scanning traffic, and more as a
96
00:02:29,189 --> 00:02:30,430
system asking one human
97
00:02:30,430 --> 00:02:32,030
question, which is whether this
98
00:02:32,030 --> 00:02:33,389
sign in matches how this person
99
00:02:33,389 --> 00:02:34,710
usually behaves.
100
00:02:34,710 --> 00:02:37,069
Two kinds of risk the user and
the sign in.
101
00:02:37,069 --> 00:02:38,750
This is the part that catches
people out.
102
00:02:38,750 --> 00:02:40,270
You might think a risky login
103
00:02:40,270 --> 00:02:41,469
and a risky account are the same
104
00:02:41,469 --> 00:02:43,030
thing, but enter ID protection
105
00:02:43,030 --> 00:02:44,310
is actually asking two different
106
00:02:44,310 --> 00:02:45,990
questions, and blending them is
107
00:02:45,990 --> 00:02:46,750
easy.
108
00:02:46,750 --> 00:02:48,389
The first is sign in risk, which
109
00:02:48,389 --> 00:02:49,870
is the chance that one specific
110
00:02:49,870 --> 00:02:51,310
sign in isn't the real account
111
00:02:51,310 --> 00:02:52,030
owner.
112
00:02:52,030 --> 00:02:53,229
It's about a single moment, one
113
00:02:53,229 --> 00:02:54,590
attempt to log in and nothing
114
00:02:54,590 --> 00:02:55,229
else.
115
00:02:55,229 --> 00:02:57,740
The second is user risk, meaning
the account itself may be
116
00:02:57,740 --> 00:03:00,139
compromised, that someone has
the keys and can come back
117
00:03:00,139 --> 00:03:00,900
whenever they want.
118
00:03:00,900 --> 00:03:03,340
This one's about the person, not
about one login.
119
00:03:03,340 --> 00:03:04,360
There's a reason to keep the two
120
00:03:04,360 --> 00:03:05,419
apart and it comes down to the
121
00:03:05,419 --> 00:03:06,060
fix.
122
00:03:06,060 --> 00:03:07,479
A risky sign in is usually
123
00:03:07,479 --> 00:03:08,580
handled right there with the
124
00:03:08,580 --> 00:03:09,139
second check.
125
00:03:09,139 --> 00:03:12,020
While a risky account often
needs a password change because
126
00:03:12,020 --> 00:03:14,460
the password itself may already
be out there.
127
00:03:14,460 --> 00:03:17,060
A quick example makes the split
click if your account suddenly
128
00:03:17,060 --> 00:03:19,939
signs in from a country you have
never visited at three in the
129
00:03:19,939 --> 00:03:21,379
morning, that's sign in risk.
130
00:03:21,379 --> 00:03:24,099
If that same account also shows
up with a password that was
131
00:03:24,099 --> 00:03:26,939
found in a data breach, that's
user risk because the
132
00:03:26,939 --> 00:03:29,539
credentials themselves are in
someone else's hands.
133
00:03:29,539 --> 00:03:31,020
Microsoft ties the two together
134
00:03:31,020 --> 00:03:32,699
with one simple rule a user
135
00:03:32,699 --> 00:03:34,139
becomes a risky user when they
136
00:03:34,139 --> 00:03:35,780
have one or more risky sign ins,
137
00:03:35,780 --> 00:03:37,360
or one or more risks detected on
138
00:03:37,360 --> 00:03:38,300
their account.
139
00:03:38,300 --> 00:03:41,460
Either path lands them on the
same list that an admin can see.
140
00:03:41,460 --> 00:03:43,180
Here is a connection worth
noticing.
141
00:03:43,180 --> 00:03:44,419
A sign in risk that nobody
142
00:03:44,419 --> 00:03:45,840
clears can roll up and add to
143
00:03:45,840 --> 00:03:47,419
the user's risk, so a single odd
144
00:03:47,419 --> 00:03:48,979
login can slowly turn into a
145
00:03:48,979 --> 00:03:49,860
flagged account.
146
00:03:49,860 --> 00:03:51,099
The two measures feed each other
147
00:03:51,099 --> 00:03:52,659
in the reports, which is why a
148
00:03:52,659 --> 00:03:54,219
person can look risky even when
149
00:03:54,219 --> 00:03:55,495
the last few sign ins seemed
150
00:03:55,495 --> 00:03:56,009
fine.
151
00:03:56,009 --> 00:03:57,409
Timing matters here too, and it
152
00:03:57,409 --> 00:03:58,689
explains something that confuses
153
00:03:58,689 --> 00:03:59,169
people.
154
00:03:59,169 --> 00:04:01,810
Some checks run while the sign
in is happening, and the details
155
00:04:01,810 --> 00:04:04,009
appear in the reports within
five to ten minutes.
156
00:04:04,009 --> 00:04:06,430
Other checks run after the fact,
and they can take up to forty
157
00:04:06,430 --> 00:04:07,569
eight hours to show up.
158
00:04:07,569 --> 00:04:08,849
Those slower checks look at the
159
00:04:08,849 --> 00:04:10,250
bigger picture, which is why a
160
00:04:10,250 --> 00:04:11,770
risk level can change a day
161
00:04:11,770 --> 00:04:12,770
later.
162
00:04:12,770 --> 00:04:14,610
What the risk levels mean once
163
00:04:14,610 --> 00:04:15,849
the checks run, they produce a
164
00:04:15,849 --> 00:04:17,529
score and that score comes in
165
00:04:17,529 --> 00:04:19,769
three levels low, medium and
166
00:04:19,769 --> 00:04:20,209
high.
167
00:04:20,209 --> 00:04:21,209
That's the whole scale.
168
00:04:21,209 --> 00:04:22,930
The plain English version goes
like this.
169
00:04:22,930 --> 00:04:25,490
High risk means Microsoft is
highly confident that the
170
00:04:25,490 --> 00:04:26,769
account is compromised.
171
00:04:26,769 --> 00:04:29,569
Medium risk means there are
moderate signs of trouble, but
172
00:04:29,569 --> 00:04:31,889
less confidence that someone
else is really in there.
173
00:04:31,889 --> 00:04:33,170
Low risk means something looked
174
00:04:33,170 --> 00:04:34,850
off and the confidence is lower
175
00:04:34,850 --> 00:04:35,370
still.
176
00:04:35,370 --> 00:04:37,790
Those levels come from machine
learning that estimates how
177
00:04:37,790 --> 00:04:40,209
likely it is that a person's
credentials are known to someone
178
00:04:40,209 --> 00:04:41,290
who shouldn't have them.
179
00:04:41,290 --> 00:04:42,569
Along with the level, Microsoft
180
00:04:42,569 --> 00:04:43,889
keeps a risk detail, which is
181
00:04:43,889 --> 00:04:45,089
the plain language reason behind
182
00:04:45,089 --> 00:04:45,810
the score.
183
00:04:45,810 --> 00:04:47,129
It lets an admin see whether the
184
00:04:47,129 --> 00:04:48,370
risk came from a leaked
185
00:04:48,370 --> 00:04:50,009
password, a spray attack or
186
00:04:50,009 --> 00:04:51,250
something the person reported
187
00:04:51,250 --> 00:04:52,050
themselves.
188
00:04:52,050 --> 00:04:53,649
Not every detection sits at one
189
00:04:53,649 --> 00:04:55,759
fixed level unfamiliar sign in
190
00:04:55,759 --> 00:04:56,920
properties, for example, can
191
00:04:56,920 --> 00:04:58,860
fire at high, medium, or low,
192
00:04:58,860 --> 00:05:00,480
depending on how unusual that
193
00:05:00,480 --> 00:05:01,480
sign in looks next to the
194
00:05:01,480 --> 00:05:02,639
person's history.
195
00:05:02,639 --> 00:05:04,680
The stranger it looks, the
higher it climbs.
196
00:05:04,680 --> 00:05:05,920
Some detections are always high
197
00:05:05,920 --> 00:05:07,699
because Microsoft isn't guessing
198
00:05:07,699 --> 00:05:09,079
leaked credentials and a
199
00:05:09,079 --> 00:05:10,800
verified threat actor IP both
200
00:05:10,800 --> 00:05:12,319
land at high risk because in
201
00:05:12,319 --> 00:05:13,399
those cases, there's real proof
202
00:05:13,399 --> 00:05:14,839
that something was exposed or
203
00:05:14,839 --> 00:05:15,680
that a known attacker is
204
00:05:15,680 --> 00:05:16,120
involved.
205
00:05:16,120 --> 00:05:17,199
There's one more detail that
206
00:05:17,199 --> 00:05:18,319
rarely makes it into beginner
207
00:05:18,319 --> 00:05:20,000
explanations, and it matters for
208
00:05:20,000 --> 00:05:21,160
expectations.
209
00:05:21,160 --> 00:05:23,759
Low risk items age out on their
own after about six months,
210
00:05:23,759 --> 00:05:26,199
which keeps the report clean,
medium and high risk.
211
00:05:26,199 --> 00:05:27,360
Don't age out and they sit there
212
00:05:27,360 --> 00:05:28,560
until someone fixes them or
213
00:05:28,560 --> 00:05:29,680
dismisses them.
214
00:05:29,680 --> 00:05:30,959
A level is really a confidence
215
00:05:30,959 --> 00:05:32,339
reading, which means a low score
216
00:05:32,339 --> 00:05:33,879
can still be worth a look, and a
217
00:05:33,879 --> 00:05:35,480
high score can occasionally be a
218
00:05:35,480 --> 00:05:36,639
false alarm that an admin
219
00:05:36,639 --> 00:05:37,360
clears.
220
00:05:37,360 --> 00:05:38,319
The level matters for two
221
00:05:38,319 --> 00:05:39,439
reasons at once, because it
222
00:05:39,439 --> 00:05:40,759
decides how urgently a person
223
00:05:40,759 --> 00:05:42,480
should look and how strict the
224
00:05:42,480 --> 00:05:44,000
automatic response is allowed to
225
00:05:44,000 --> 00:05:44,800
be.
226
00:05:44,800 --> 00:05:46,879
How risk turns into a decision.
227
00:05:46,879 --> 00:05:48,279
A score on its own does nothing.
228
00:05:48,279 --> 00:05:49,759
It has to turn into a decision.
229
00:05:49,759 --> 00:05:52,040
And that decision is where the
whole concept pays off.
230
00:05:52,040 --> 00:05:54,360
The score gets handed to
Microsoft Entra conditional
231
00:05:54,360 --> 00:05:56,079
access if that name is new.
232
00:05:56,079 --> 00:05:58,560
Think of conditional access as a
set of.
233
00:05:58,560 --> 00:06:00,920
If this, then that rules for
signing in.
234
00:06:00,920 --> 00:06:03,279
When a condition is true, a rule
fires.
235
00:06:03,279 --> 00:06:04,839
Two of those conditions come
straight from.
236
00:06:04,839 --> 00:06:08,120
Enter ID protection and their
sign in risk and user risk
237
00:06:08,120 --> 00:06:10,480
during every sign in the
protection layer sends the
238
00:06:10,480 --> 00:06:13,319
detected levels over and the
rules get evaluated.
239
00:06:13,319 --> 00:06:14,459
Each policy can be set to
240
00:06:14,459 --> 00:06:16,319
trigger at low, medium, high or
241
00:06:16,319 --> 00:06:17,639
no risk detected, so an
242
00:06:17,639 --> 00:06:18,680
organization tunes the
243
00:06:18,680 --> 00:06:19,959
strictness to its own comfort
244
00:06:19,959 --> 00:06:20,720
level.
245
00:06:20,720 --> 00:06:23,360
A cautious company might
challenge a medium risk sign in,
246
00:06:23,360 --> 00:06:26,199
while a more relaxed one waits
for high from the person's side,
247
00:06:26,199 --> 00:06:27,519
it looks like a normal prompt.
248
00:06:27,519 --> 00:06:28,560
They don't get a security
249
00:06:28,560 --> 00:06:29,680
lecture, they just have to prove
250
00:06:29,680 --> 00:06:30,240
it's them.
251
00:06:30,240 --> 00:06:32,439
For sign in risk, the choices
are easy to follow.
252
00:06:32,439 --> 00:06:35,120
The rule can block the sign in,
allow it require multifactor
253
00:06:35,120 --> 00:06:37,560
authentication, or require the
person to sign in again.
254
00:06:37,560 --> 00:06:38,759
If the person completes the
255
00:06:38,759 --> 00:06:40,519
required step, like a prompt on
256
00:06:40,519 --> 00:06:42,160
their phone, the risk clears on
257
00:06:42,160 --> 00:06:42,759
the spot.
258
00:06:42,759 --> 00:06:44,040
For user risk, the choices are
259
00:06:44,040 --> 00:06:45,199
require risk remediation,
260
00:06:45,199 --> 00:06:46,600
require a password change, or
261
00:06:46,600 --> 00:06:47,319
block access.
262
00:06:47,319 --> 00:06:48,519
Those three aim at a different
263
00:06:48,519 --> 00:06:50,079
problem because user risk means
264
00:06:50,079 --> 00:06:51,399
the account itself may be in the
265
00:06:51,399 --> 00:06:52,069
wrong hands.
266
00:06:52,069 --> 00:06:53,470
The middle option require risk
267
00:06:53,470 --> 00:06:55,069
remediation is the clever one,
268
00:06:55,069 --> 00:06:56,029
and it deserves a plain
269
00:06:56,029 --> 00:06:57,029
explanation.
270
00:06:57,029 --> 00:06:58,750
It adapts to how the person
signs in.
271
00:06:58,750 --> 00:07:00,149
If they use a password, it asks
272
00:07:00,149 --> 00:07:01,790
for a secure password change and
273
00:07:01,790 --> 00:07:02,790
then cuts off their old
274
00:07:02,790 --> 00:07:03,189
sessions.
275
00:07:03,189 --> 00:07:04,230
If they sign in without a
276
00:07:04,230 --> 00:07:05,189
password, it cuts off the
277
00:07:05,189 --> 00:07:06,470
sessions and asks them to sign
278
00:07:06,470 --> 00:07:07,269
in again.
279
00:07:07,269 --> 00:07:09,550
One policy different fix chosen
automatically.
280
00:07:09,550 --> 00:07:10,790
This is where automation earns
281
00:07:10,790 --> 00:07:12,629
its keep at the scale Microsoft
282
00:07:12,629 --> 00:07:13,110
operates.
283
00:07:13,110 --> 00:07:16,269
No team could review every sign
in by hand, so the rules handle
284
00:07:16,269 --> 00:07:18,990
the common cases and leave only
the strange ones for a person.
285
00:07:18,990 --> 00:07:20,029
There's a rule about stacking
286
00:07:20,029 --> 00:07:21,350
these that keeps admins out of
287
00:07:21,350 --> 00:07:21,910
trouble.
288
00:07:21,910 --> 00:07:23,149
Risk remediation beats a
289
00:07:23,149 --> 00:07:24,670
password change and block beats
290
00:07:24,670 --> 00:07:25,470
everything else.
291
00:07:25,470 --> 00:07:28,389
Don't pile several of these onto
the same person because only the
292
00:07:28,389 --> 00:07:30,629
strongest one wins and the rest
go to waste.
293
00:07:30,629 --> 00:07:32,629
One honest limitation is worth
knowing.
294
00:07:32,629 --> 00:07:33,990
The full risk remediation flow
295
00:07:33,990 --> 00:07:35,189
doesn't work for guests and
296
00:07:35,189 --> 00:07:36,470
external users, because
297
00:07:36,470 --> 00:07:37,709
Microsoft doesn't revoke
298
00:07:37,709 --> 00:07:38,949
sessions for those accounts the
299
00:07:38,949 --> 00:07:40,870
same way how people fix it
300
00:07:40,870 --> 00:07:41,589
themselves.
301
00:07:41,589 --> 00:07:43,709
Now we get to the part beginners
like best.
302
00:07:43,709 --> 00:07:45,209
Most of the time, nobody from it
303
00:07:45,209 --> 00:07:46,470
has to get involved because the
304
00:07:46,470 --> 00:07:47,709
person clears the risk on their
305
00:07:47,709 --> 00:07:48,149
own.
306
00:07:48,149 --> 00:07:50,704
Microsoft calls the self
remediation, and it's exactly as
307
00:07:50,704 --> 00:07:51,459
simple as it sounds.
308
00:07:51,459 --> 00:07:52,819
If it's sign in risk, the person
309
00:07:52,819 --> 00:07:54,259
gets prompted for multi-factor
310
00:07:54,259 --> 00:07:55,060
authentication.
311
00:07:55,060 --> 00:07:56,779
That's the second proof we keep
coming back to.
312
00:07:56,779 --> 00:07:58,939
Usually a code or an approval on
a phone.
313
00:07:58,939 --> 00:08:02,000
Once they pass it, the risk
state flips from at risk to
314
00:08:02,000 --> 00:08:04,500
remediated, and they carry on
with their day.
315
00:08:04,500 --> 00:08:06,259
If it's user risk and the policy
316
00:08:06,259 --> 00:08:07,459
asks for a password change, the
317
00:08:07,459 --> 00:08:08,779
person completes multi-factor
318
00:08:08,779 --> 00:08:10,339
authentication and then sets a
319
00:08:10,339 --> 00:08:11,259
new password.
320
00:08:11,259 --> 00:08:14,540
The risk clears and their old
sessions get cut off, so anyone
321
00:08:14,540 --> 00:08:16,459
holding the old password is
locked out, too.
322
00:08:16,459 --> 00:08:19,060
There's one honest nuance here
because people mix these two up.
323
00:08:19,060 --> 00:08:21,740
This is a secure password change
where the person still knows
324
00:08:21,740 --> 00:08:24,019
their current password and
simply replaces it.
325
00:08:24,019 --> 00:08:26,860
It isn't the same as a forgotten
password reset, and it only
326
00:08:26,860 --> 00:08:29,180
works if the person already
registered a second factor,
327
00:08:29,180 --> 00:08:32,299
which is why setting that up
ahead of time matters so much.
328
00:08:32,299 --> 00:08:35,460
Sometimes the system clears the
risk all by itself if the person
329
00:08:35,460 --> 00:08:38,580
provides a second factor, or if
a later check decides the sign
330
00:08:38,580 --> 00:08:41,299
in is no longer risky, the risk
gets dismissed automatically and
331
00:08:41,299 --> 00:08:42,580
stops counting against them.
332
00:08:42,580 --> 00:08:44,779
When it can't be cleared, an
admin steps in.
333
00:08:44,779 --> 00:08:45,899
They can issue a temporary
334
00:08:45,899 --> 00:08:47,460
password, require a password
335
00:08:47,460 --> 00:08:48,700
change, dismiss the risk,
336
00:08:48,700 --> 00:08:49,929
confirm that the account is
337
00:08:49,929 --> 00:08:51,210
compromised or unblocked the
338
00:08:51,210 --> 00:08:51,769
person.
339
00:08:51,769 --> 00:08:52,970
A temporary password brings the
340
00:08:52,970 --> 00:08:54,250
account back to a safe state
341
00:08:54,250 --> 00:08:55,610
right away, with the catch that
342
00:08:55,610 --> 00:08:56,970
the person has to be told what
343
00:08:56,970 --> 00:08:57,570
it is.
344
00:08:57,570 --> 00:08:59,289
Hybrid users aren't left out
either.
345
00:08:59,289 --> 00:09:01,649
If your organization keeps
accounts on an on premises
346
00:09:01,649 --> 00:09:04,809
server as well as in the cloud,
one more setting matters with
347
00:09:04,809 --> 00:09:07,809
password hash synchronization
switched on, a password change
348
00:09:07,809 --> 00:09:10,330
made on a company device can
clear the user's risk to.
349
00:09:10,330 --> 00:09:11,289
The whole point of this design
350
00:09:11,289 --> 00:09:12,590
is to take load off the help
351
00:09:12,590 --> 00:09:13,009
desk.
352
00:09:13,009 --> 00:09:14,129
A person who can fix their own
353
00:09:14,129 --> 00:09:15,730
risk is one fewer ticket and one
354
00:09:15,730 --> 00:09:16,610
faster fix.
355
00:09:16,610 --> 00:09:18,809
There's also a safety net
underneath all of this.
356
00:09:18,809 --> 00:09:20,330
Microsoft automatically blocks
357
00:09:20,330 --> 00:09:21,610
sign ins that carry very high
358
00:09:21,610 --> 00:09:23,289
confidence of being risky, most
359
00:09:23,289 --> 00:09:24,730
often from old style sign in
360
00:09:24,730 --> 00:09:26,090
methods that skip modern
361
00:09:26,090 --> 00:09:26,929
protections.
362
00:09:26,929 --> 00:09:29,970
That's one more reason to move
away from those older methods.
363
00:09:29,970 --> 00:09:32,809
What the admin actually sees
when something can't be cleared
364
00:09:32,809 --> 00:09:35,610
automatically, it lands in front
of a human and the reports are
365
00:09:35,610 --> 00:09:36,490
built for that moment.
366
00:09:36,490 --> 00:09:37,730
There are three main reports.
367
00:09:37,730 --> 00:09:39,070
Risk detection shows each
368
00:09:39,070 --> 00:09:40,250
individual thing that was
369
00:09:40,250 --> 00:09:40,850
noticed.
370
00:09:40,850 --> 00:09:42,330
Risky sign ins shows sign ins
371
00:09:42,330 --> 00:09:43,450
that carry one or more of those
372
00:09:43,450 --> 00:09:44,169
detections.
373
00:09:44,169 --> 00:09:46,129
Risky users shows the accounts
374
00:09:46,129 --> 00:09:47,610
because a user gets flagged when
375
00:09:47,610 --> 00:09:48,970
they have a risky sign in or a
376
00:09:48,970 --> 00:09:50,490
detection on their account, and
377
00:09:50,490 --> 00:09:51,690
admin starts by looking at the
378
00:09:51,690 --> 00:09:53,210
dashboard and the reports, then
379
00:09:53,210 --> 00:09:54,570
checks the sign in logs for
380
00:09:54,570 --> 00:09:55,610
other accounts with the same
381
00:09:55,610 --> 00:09:56,169
fingerprint.
382
00:09:56,169 --> 00:09:59,230
If five accounts all failed from
the same IP address in the same
383
00:09:59,230 --> 00:10:02,649
hour, that pattern matters far
more than any single event.
384
00:10:02,649 --> 00:10:05,049
Then comes the judgment call at
the center of the whole job,
385
00:10:05,049 --> 00:10:07,090
which is deciding whether the
alert is real.
386
00:10:07,090 --> 00:10:08,509
An admin can confirm a sign in
387
00:10:08,509 --> 00:10:10,129
is compromised, confirm it as
388
00:10:10,129 --> 00:10:11,690
safe, or dismiss it as a true
389
00:10:11,690 --> 00:10:12,970
positive that turned out
390
00:10:12,970 --> 00:10:13,610
harmless.
391
00:10:13,610 --> 00:10:16,570
The difference between those
last two is small but real.
392
00:10:16,570 --> 00:10:19,250
Confirming safe tells the system
this was a false alarm.
393
00:10:19,250 --> 00:10:21,809
While dismissing says the alert
was real but harmless.
394
00:10:21,809 --> 00:10:23,210
The way a planned security test
395
00:10:23,210 --> 00:10:24,570
looks suspicious without being
396
00:10:24,570 --> 00:10:26,049
an attack.
397
00:10:26,049 --> 00:10:28,129
The details pane is where the
story fills in.
398
00:10:28,129 --> 00:10:29,610
It shows the app the person was
399
00:10:29,610 --> 00:10:31,049
reaching for the device, the
400
00:10:31,049 --> 00:10:32,730
location, and the IP address,
401
00:10:32,730 --> 00:10:33,789
which is usually enough to
402
00:10:33,789 --> 00:10:35,090
separate a real attack from a
403
00:10:35,090 --> 00:10:35,970
false alarm.
404
00:10:35,970 --> 00:10:37,370
For bigger teams, the reports
405
00:10:37,370 --> 00:10:38,769
can be exported or read through
406
00:10:38,769 --> 00:10:40,809
an API so the data can flow into
407
00:10:40,809 --> 00:10:42,049
a security tool the company
408
00:10:42,049 --> 00:10:42,889
already uses.
409
00:10:42,889 --> 00:10:45,809
If an admin confirms that an
account is compromised, there's
410
00:10:45,809 --> 00:10:47,080
a short list of moves.
411
00:10:47,080 --> 00:10:48,159
Reset the password.
412
00:10:48,159 --> 00:10:49,080
Block the account.
413
00:10:49,080 --> 00:10:50,519
Revoke the tokens that keep the
414
00:10:50,519 --> 00:10:52,120
session alive, and disable a
415
00:10:52,120 --> 00:10:53,200
compromised device.
416
00:10:53,200 --> 00:10:54,720
Revoking sessions is the step
417
00:10:54,720 --> 00:10:56,039
people forget, and it's often
418
00:10:56,039 --> 00:10:57,320
the one that actually pushes an
419
00:10:57,320 --> 00:10:58,240
attacker out.
420
00:10:58,240 --> 00:10:59,120
The reports don't keep
421
00:10:59,120 --> 00:11:00,120
everything forever, so
422
00:11:00,120 --> 00:11:01,779
expectations should match risky
423
00:11:01,779 --> 00:11:02,200
sign ins.
424
00:11:02,200 --> 00:11:05,120
Go back thirty days and risk
detections go back ninety days.
425
00:11:05,120 --> 00:11:08,159
This is also a controlled job,
not a free for all.
426
00:11:08,159 --> 00:11:10,159
A security reader can look
without changing anything.
427
00:11:10,159 --> 00:11:12,960
A security operator can act on
risks and changing the policies.
428
00:11:12,960 --> 00:11:14,159
Needs a security administrator
429
00:11:14,159 --> 00:11:15,039
or a conditional access
430
00:11:15,039 --> 00:11:16,159
administrator.
431
00:11:16,159 --> 00:11:17,679
What it costs and what you need
432
00:11:17,679 --> 00:11:18,679
before any of this matters to
433
00:11:18,679 --> 00:11:18,799
you.
434
00:11:18,799 --> 00:11:21,120
There's one practical question
to settle, which is whether you
435
00:11:21,120 --> 00:11:21,720
actually have it.
436
00:11:21,720 --> 00:11:23,000
Now for the practical part.
437
00:11:23,000 --> 00:11:26,019
Full entry ID protection needs a
license called Microsoft entry
438
00:11:26,019 --> 00:11:26,720
ID P two.
439
00:11:26,720 --> 00:11:28,120
And that single requirement is
440
00:11:28,120 --> 00:11:29,639
what trips people up without P
441
00:11:29,639 --> 00:11:29,960
two.
442
00:11:29,960 --> 00:11:31,360
You aren't completely blind, but
443
00:11:31,360 --> 00:11:32,840
you're limited in the free and
444
00:11:32,840 --> 00:11:33,519
P1 versions.
445
00:11:33,519 --> 00:11:36,320
Only medium and high risk users
even show up, and there's no
446
00:11:36,320 --> 00:11:38,600
details panel and no risk
history to dig through.
447
00:11:38,600 --> 00:11:41,440
You also can't turn the risk
policies on at all, and
448
00:11:41,440 --> 00:11:44,559
detections show up as a vague
additional risk detected with no
449
00:11:44,559 --> 00:11:45,750
detail behind them.
450
00:11:45,750 --> 00:11:46,809
So here's the sentence to
451
00:11:46,809 --> 00:11:47,929
remember about the two paid
452
00:11:47,929 --> 00:11:48,590
tiers.
453
00:11:48,590 --> 00:11:51,710
Conditional access itself comes
with P1, but the risk based
454
00:11:51,710 --> 00:11:53,269
version of it needs P2.
455
00:11:53,269 --> 00:11:55,549
That single distinction explains
most of the confusion.
456
00:11:55,549 --> 00:11:56,789
P1 does give you conditional
457
00:11:56,789 --> 00:11:57,710
access and multi-factor
458
00:11:57,710 --> 00:11:59,230
authentication, but it doesn't
459
00:11:59,230 --> 00:12:00,190
give you the risk engine
460
00:12:00,190 --> 00:12:01,710
underneath them, and that engine
461
00:12:01,710 --> 00:12:02,710
is the reason the feature
462
00:12:02,710 --> 00:12:03,429
exists.
463
00:12:03,429 --> 00:12:05,789
The good news is that plenty of
workplaces already have this,
464
00:12:05,789 --> 00:12:07,389
and nobody realizes.
465
00:12:07,389 --> 00:12:09,269
Entry ID two ships with
Microsoft three.
466
00:12:09,269 --> 00:12:12,470
Sixty five E5 The Microsoft
Defender Suite Enterprise
467
00:12:12,470 --> 00:12:15,830
Mobility Plus Security E5, and
the entry suite, which folds in
468
00:12:15,830 --> 00:12:17,830
several other identity products
along with it.
469
00:12:17,830 --> 00:12:19,870
The lighter tier entry ID, P1
470
00:12:19,870 --> 00:12:20,870
ships with Microsoft three
471
00:12:20,870 --> 00:12:22,149
hundred sixty five, E3, and
472
00:12:22,149 --> 00:12:23,110
Business Premium.
473
00:12:23,110 --> 00:12:25,710
If your company runs on one of
those plans, the feature may
474
00:12:25,710 --> 00:12:28,070
already be sitting there, paid
for, and switched off.
475
00:12:28,070 --> 00:12:29,990
There's one caveat about
detections.
476
00:12:29,990 --> 00:12:31,070
Some of them come from other
477
00:12:31,070 --> 00:12:32,669
Microsoft Defender products, so
478
00:12:32,669 --> 00:12:33,909
those specific signals only
479
00:12:33,909 --> 00:12:35,029
appear if you also have the
480
00:12:35,029 --> 00:12:36,110
matching license.
481
00:12:36,110 --> 00:12:38,590
An empty report doesn't always
mean everything is fine.
482
00:12:38,590 --> 00:12:40,750
There's also a note for the
future facing crowd.
483
00:12:40,750 --> 00:12:44,679
The newer reporting covers risky
agents, too, because AI agents
484
00:12:44,679 --> 00:12:48,419
now sign in and hold access,
just like people do.
485
00:12:48,419 --> 00:12:50,220
Best practices that actually
matter.
486
00:12:50,220 --> 00:12:51,659
If you take only a handful of
487
00:12:51,659 --> 00:12:53,419
setup steps away from this, make
488
00:12:53,419 --> 00:12:54,059
them these.
489
00:12:54,059 --> 00:12:56,139
The one that prevents disaster
comes first.
490
00:12:56,139 --> 00:12:59,299
Exclude your emergency accounts
and keep a break glass account
491
00:12:59,299 --> 00:13:01,019
that these policies never touch.
492
00:13:01,019 --> 00:13:02,820
So a misconfiguration can't lock
493
00:13:02,820 --> 00:13:03,899
everyone out of the building at
494
00:13:03,899 --> 00:13:04,580
once.
495
00:13:04,580 --> 00:13:06,539
Service accounts deserve the
same care.
496
00:13:06,539 --> 00:13:09,340
Next, get people registered for
multi-factor authentication
497
00:13:09,340 --> 00:13:10,299
before they need it.
498
00:13:10,299 --> 00:13:13,179
Self remediation depends on the
person already having a second
499
00:13:13,179 --> 00:13:14,179
factor set up.
500
00:13:14,179 --> 00:13:17,139
So the MFA registration policy
isn't optional.
501
00:13:17,139 --> 00:13:19,139
It's the foundation everything
else stands on.
502
00:13:19,139 --> 00:13:20,980
Then mark your trusted
locations.
503
00:13:20,980 --> 00:13:22,100
When you tell the system which
504
00:13:22,100 --> 00:13:23,700
networks and VPN ranges are
505
00:13:23,700 --> 00:13:25,419
known and safe, sign ins from
506
00:13:25,419 --> 00:13:26,740
those places lower a person's
507
00:13:26,740 --> 00:13:27,980
risk and cut down on false
508
00:13:27,980 --> 00:13:28,779
alarms.
509
00:13:28,779 --> 00:13:29,659
That step isn't just a
510
00:13:29,659 --> 00:13:30,940
convenience either, because it
511
00:13:30,940 --> 00:13:32,100
teaches the system what a safe
512
00:13:32,100 --> 00:13:33,340
signing looks like and sharpens
513
00:13:33,340 --> 00:13:34,340
every judgment it makes
514
00:13:34,340 --> 00:13:34,779
afterward.
515
00:13:34,779 --> 00:13:37,700
Before you enforce anything, use
report only mode.
516
00:13:37,700 --> 00:13:40,100
It shows you exactly what a
policy would have done before
517
00:13:40,100 --> 00:13:42,299
you switch it on and start
blocking real people.
518
00:13:42,299 --> 00:13:44,019
When you do enforce, start
small.
519
00:13:44,019 --> 00:13:45,580
Scope a new policy to a test
group.
520
00:13:45,580 --> 00:13:46,899
Watch how it behaves for a week
521
00:13:46,899 --> 00:13:48,220
and widen it out once you trust
522
00:13:48,220 --> 00:13:48,620
it.
523
00:13:48,620 --> 00:13:52,419
Turn on the notifications to ask
for an alert when a user gets
524
00:13:52,419 --> 00:13:53,899
flagged and a weekly digest.
525
00:13:53,899 --> 00:13:56,659
So risk doesn't sit unseen in a
report and nobody opens.
526
00:13:56,659 --> 00:13:59,139
And before any of that review
the existing reports.
527
00:13:59,139 --> 00:14:00,340
If there are already flagged
528
00:14:00,340 --> 00:14:02,139
users, you want to know that
529
00:14:02,139 --> 00:14:03,539
before you turn on enforcement
530
00:14:03,539 --> 00:14:04,860
and then wonder why half the
531
00:14:04,860 --> 00:14:06,440
company is being blocked, if you
532
00:14:06,440 --> 00:14:07,840
can simulate a threat during
533
00:14:07,840 --> 00:14:09,139
testing so your team has
534
00:14:09,139 --> 00:14:10,419
practiced the response before it
535
00:14:10,419 --> 00:14:11,419
counts.
536
00:14:11,419 --> 00:14:13,100
A quick recap and one question.
537
00:14:13,100 --> 00:14:14,379
So let's bring it together.
538
00:14:14,379 --> 00:14:16,740
Enter ID protection which is how
people sign in.
539
00:14:16,740 --> 00:14:20,220
It scores user risk and sign in
risk as low, medium or high.
540
00:14:20,220 --> 00:14:21,240
It hands that score to
541
00:14:21,240 --> 00:14:22,299
conditional access, which
542
00:14:22,299 --> 00:14:23,580
decides whether to allow the
543
00:14:23,580 --> 00:14:25,019
sign in, block it, or ask for
544
00:14:25,019 --> 00:14:25,740
proof.
545
00:14:25,740 --> 00:14:28,340
In most cases, people clear the
risk themselves with a second
546
00:14:28,340 --> 00:14:31,200
check or a secure password
change, and anything left over
547
00:14:31,200 --> 00:14:33,539
goes to an admin who
investigates and acts.
548
00:14:33,539 --> 00:14:35,100
Here's the question I'll leave
you with.
549
00:14:35,100 --> 00:14:36,460
If a stolen password is the most
550
00:14:36,460 --> 00:14:37,980
common way in, and the second
551
00:14:37,980 --> 00:14:39,480
check stops nearly all of it,
552
00:14:39,480 --> 00:14:40,700
why is a password on its own
553
00:14:40,700 --> 00:14:42,019
still the default in so many
554
00:14:42,019 --> 00:14:42,820
places?
