Over the last few weeks we have noticed an increase in the number of false positives and alerts generated by AAD identity Protection. Generally, they've been flagged as "impossible travel" from overseas locations.
The concerning part is, all of the "risky" login attempts have been failures, but the accounts are marked as 'high risk' after multiple failed attempts by third parties. Dismissing or confirming these alerts seem inaccurate based on the behavior.
Dismissing the risk would train the system these login attempts were legitimate.
Confirming they're compromised would be inaccurate as these accounts have not been successfully logged into by the malicious actors.
Has anyone else seen this type of behavior?
