Who is Your Company's Riskiest User?

Wouldn’t it be great if we could detect when our user accounts were being used in places it would have been impossible for us to travel to? How protected would you feel if you knew users exhibiting risky, anomalous behavior were automatically challenged for a second layer of authentication? Maybe we should run a system to alert administrators when these kinds of things were going on!

If you haven't guessed it so far, my cheesy delivery is failing. We can do all of that today.

Azure Active Directory Identity Protection is the very same security Microsoft uses to protect its own internal identities. It incorporates machine learning algorithms and heuristics to detect, assess and if configured, take action on suspicious behavior.

The automatic responses to risky situations means we can impose tougher security when it is called for, situationally. The user benefits because normal behavior is rewarded with a less authentication challenged experience. Automatic responses include multi-factor authentication enforcement or even a password reset. It can be tuned to be extremely sensitive to risk, or take action only when very obvious malicious activity is occurring.

We can report on the riskiest user accounts, review security posture recommendations and look at all of that on pretty dashboards.

I've included a few of the more interesting screenshots and the link to the Microsoft documentation on this technology.

Identity Protection capabilities

Detecting vulnerabilities and risky accounts:

• Providing custom recommendations to improve overall security posture by highlighting vulnerabilities
• Calculating sign-in risk levels
• Calculating user risk levels

Investigating risk events:

• Sending notifications for risk events
• Investigating risk events using relevant and contextual information
• Providing basic workflows to track investigations
• Providing easy access to remediation actions such as password reset

Risk-based conditional access policies:

• Policy to mitigate risky sign-ins by blocking sign-ins or requiring multi-factor authentication challenges.
• Policy to block or secure risky user accounts
• Policy to require users to register for multi-factor authentication

Identity Protection dashboard.