Risky Sign-in Report - Where to see or adjust the settings?

[NoobieInfoSec]

We are seeing some inconsistencies with our Risky Sign-in reports.  For example, we'll have multiple users who travel over seas, logging in from foreign IP addresses for the first time, and some will get flagged as a risky sign in while others won't.  We had one US based user in particular who travelled in Eastern Europe for a month and was never flagged for risky sign ons.

Is there a way to see and or adjust the settings/criterion for how the risky sign-in reports work?

[#2]

This falls under Azure AD IP - There’s an article about simulating some of the behaviors to test -> https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protectio...

Can you have a look if that works for you?

[#3]

Sure, I will test these out - thank you!

Is there a way for us to configure how risky sign in works? Like turn certain features ON or OFF?

[#4 · Accepted solution]

I am not an Azure AD IP expert, but did you look at our documentation? https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protectio...
There is also a YouTube video in this article.
For reports I found this page: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protectio...
If the simulation from earlier doesn't help, I honestly would suggest to open a support ticket to see why some users are flagged, whilst others are not.