Users flagged for risk - Azure AD Identity Protection

Jerry Gonzalez 

It's a little bit late, but i think this could help others:

You can read about this here:

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-close-active-risk-events#close-individual-risk-events-manually

So, in your case (travel to canada) the best option would have been "Resolve" or "Ignore".

• Resolve - If after investigating a risk event, you took an appropriate remediation action outside Identity Protection, and you believe that the risk event should be considered closed, mark the event as Resolved. Resolved events will set the risk event’s status to Closed and the risk event will no longer contribute to user risk.

• Mark as false-positive - In some cases, you may investigate a risk event and discover that it was incorrectly flagged as a risky. You can help reduce the number of such occurrences by marking the risk event as False-positive. This will help the machine learning algorithms to improve the classification of similar events in the future. The status of false-positive events is to Closed and they will no longer contribute to user risk.

• Ignore - If you have not taken any remediation action, but want the risk event to be removed from the active list, you can mark a risk event Ignore and the event status will be Closed. Ignored events do not contribute to user risk. This option should only be used under unusual circumstances.

• Reactivate - Risk events that were manually closed (by choosing Resolve, False positive, or Ignore) can be reactivated, setting the event status back to Active. Reactivated risk events contribute to the user risk level calculation. Risk events closed through remediation (such as a secure password reset) cannot be reactivated.