Are actions performed on risky users and risky sign-ins like
- Confirm user compromised
- Dismiss user risk
- Block user
- Confirm sign-ins compromised
- Confirm sign-ins safe
logged in an audit log?
I would like to understand why (or by who) the risk state of risky users was dismissed or remediated (since it wasn't by an admin).
