Forum Discussion
Risky sign-ins not showing anything
Hi,
For some time already, I am not sure why but I cannot see anything in risky sign-ins in Identity Protection (MS Entra). Even when I receive a summary email (Microsoft Entra ID Protection Weekly Digest) mentioning there were risky sinn-ings detected.
When I click on the risky signings directly in the email to take me to the report, I see no data there at all... When I modify filters to include all, nothing shows up either. It has been like this for few months already. Before, I could see them with no issues.
Has anything changed? Or why I can't see any records?
6 Replies
This has been my experience for the last two years. It's a half implemented feature, because all the devs were pivoted to AI Market Capture.
I sometimes have luck removing all filter options. But also, it's important to note that the 4-6 different ways 'risky users' is exposed to admins all seem to having varying refresh rates. Like... I actually can't even remember the number of react components/blades that exist to show you risky users, because there are so many - and while the UI is surprisingly well-designed for a Microsoft feature, the backend is clearly wet garbage.
Another thing to consider is that they may have been automatically remediated. This happens a LOT, and in my experience, this usually means there's no record of it. There's supposed to be. But Satya Nadella wants everyone focused on AI, so tough luck.See my solution on this post:
https://learn.microsoft.com/en-us/answers/questions/5909613/entra-id-protection-weekly-digest-shows-risky-sign
Your solution? You don't have a post in there.
Sorry, I had a different username on techcommunity.microsoft.com than I did on learn.microsoft.com. I just updated it to be the same. My answer is the one that starts with:
TL;DR: Some risky sign-in (real-time) events may have a Risk State = none, and the only way to view those is to deselect all of the Risk State filters.
I have this exact same issue. Not sure if it is a licence thing where the users only have entra P1 with business premium and that does not have the necessary rights to view data or if I have not configured something.
No, it's a bad leadership thing.
