Microsoft Risk Detections

Microsoft risk detections

Microsoft 365 and Entra ID (Azure AD) have their own security signals—risk detections and risky user flags that Microsoft generates from sign-ins, identity protection, and other sources. Petra can surface these in the reporting hub so you see both Petra's own findings and Microsoft's in one place. This article explains what Microsoft risk detections are and how they appear in Petra.

What Microsoft risk detections are

Microsoft continuously evaluates sign-ins and user behavior and may flag "risky" sign-ins or "risky" users when something doesn't look right—for example, sign-in from an unfamiliar location, impossible travel, or behavior that matches known attack patterns. These are often shown in the Microsoft 365 admin center or Entra ID Identity Protection. In Petra, we can pull in those risk detections (or a subset of them) and display them in the reporting hub under a tab like "Microsoft risk detections" or "P1/P2 risk detections." That way you don't have to switch to the Microsoft portal to see what Microsoft is flagging; you can see it alongside Petra's incidents and other events.

What you'll see

In the Microsoft risk detections view you'll typically see a list of risk events: the user involved, the type of risk (e.g., unfamiliar sign-in, leaked credentials), the date and time, and often a link or reference to more details. You can filter by date range or user. Some risk detections may overlap with incidents Petra created—for example, the same sign-in might trigger both a Microsoft risk and a Petra incident. Seeing both helps you correlate and avoid duplicate work while making sure you don't miss something that only one system caught.

How to use them

Use Microsoft risk detections as an additional signal. If Petra didn't create an incident for a given risk, you can still review it and decide whether to investigate or take action (e.g., require password reset or MFA). If Petra did create an incident, the risk detection may add context. Having Microsoft and Petra data in one place simplifies triage and gives you a more complete view of identity and sign-in risk for your tenants.