Forum Discussion
Solved
Users flagged for risk - Azure AD Identity Protection
So new to the Azure AD Identity Protection.
So I get the email for Azure AD Identity Protection Weekly Digest. So my user visits Canada and I get the alert and I know he is in Canada, I have confirm it with him and his Admin. Under details, do I mark Resolve or Mark as false positive.
I would believe it should be mark as false positive so yes the person did visit this location.
Please confirm if I am correct, thanks.
I would agree with you that this would be considered a false positive if the user did visit the country noted. I would suggest using "Resolved" if, for example, you found that he did not visit the country so you reset the password on the account and investigated the event further.
It's a little bit late, but i think this could help others:
You can read about this here:
So, in your case (travel to canada) the best option would have been "Resolve" or "Ignore".
Resolve - If after investigating a risk event, you took an appropriate remediation action outside Identity Protection, and you believe that the risk event should be considered closed, mark the event as Resolved. Resolved events will set the risk event’s status to Closed and the risk event will no longer contribute to user risk.
Mark as false-positive - In some cases, you may investigate a risk event and discover that it was incorrectly flagged as a risky. You can help reduce the number of such occurrences by marking the risk event as False-positive. This will help the machine learning algorithms to improve the classification of similar events in the future. The status of false-positive events is to Closed and they will no longer contribute to user risk.
Ignore - If you have not taken any remediation action, but want the risk event to be removed from the active list, you can mark a risk event Ignore and the event status will be Closed. Ignored events do not contribute to user risk. This option should only be used under unusual circumstances.
Reactivate - Risk events that were manually closed (by choosing Resolve, False positive, or Ignore) can be reactivated, setting the event status back to Active. Reactivated risk events contribute to the user risk level calculation. Risk events closed through remediation (such as a secure password reset) cannot be reactivated.
- Thanks for the link.
Short question. by default are there any User Risk oder Identity Risk Policies activated which act by default? As example block the sign in or something which creates an impact. IM asking before we add Licenses to our Contract to know if i have to configure something before. Because our Users are highly traveling around the world and i dont want to have any impact because of a false detection, dont want to have 200 accounts blocked because of a automatic acting policy.
Thank you very much.
I would agree with you that this would be considered a false positive if the user did visit the country noted. I would suggest using "Resolved" if, for example, you found that he did not visit the country so you reset the password on the account and investigated the event further.
- Thanks!
