Forum Discussion

Shane Toal's avatar
Shane Toal
Copper Contributor
Jun 12, 2017

Users flagged for risk

I am seeing quite a few of my customers Office 365 users flagged for risk in Azure AD and recieving a notificaiton in their Office 365 portal.   It seems without a Azure AD premium you can't tell w...
security
Jonathan Frericks's avatar
Jonathan Frericks
Copper Contributor
Jul 24, 2017

I agree. It feels like an upsell attempt. 

 

I got a list of 100+ at-risk users. The first one I investigated had a mere 4 connections from a single application, from a single source IP. The only thing suspicious was how infrequently the user checked their email from their phone.

 

The main problem now is that the managers are starting to panic. 

 

 

Daniel Westerdale's avatar
Daniel Westerdale
Iron Contributor
Jul 25, 2017

Hi

 

I have enabled AD Premium 30 day trial  on half of a client via the AD Admin Classic Portal.  I have 20 or so users flagged for risk to step through. I wondered if there isn't a bit of PowerShell to create a CSV file listing each user and risk notification. 

Resources