Forum Discussion

StephanGee's avatar
StephanGee
Iron Contributor
May 29, 2020

Disabled Users in Azure AD / Blocked User in Office 365 / Risky SignIn Blocked

Hi,   today a colleague clicked a phishing mail and entered his mail and password. After seconds there was a login from Belize which was blocked due to our Conditional Access Rules.   But i decid...
Access Management
ChristianBergstrom's avatar
ChristianBergstrom
Silver Contributor
May 29, 2020

StephanGee Hello Stephan, did you ever press 'Confirm sign-in(s) safe' in Identity Protection under Risky sign-ins? I'm attaching a couple of links in case you haven't seen these.

 

Remediate risks and unblock users

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-remediate-unblock

 

How should I give risk feedback and what happens under the hood?

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-risk-feedback#how-should-i-give-risk-feedback-and-what-happens-under-the-hood

 

Let me know how it goes!

StephanGee's avatar
StephanGee
Iron Contributor
May 29, 2020

ChristianBergstrom 

I just let the user change his password and then unblocked the account.

Did not know that i have to set the user to safe again. I thought that this was just for the books and had no more influence.

I think the colleague will check tomorrow again. Last try to login was about an hour ago.

Resources