Microsoft Entra Risk & Identity Protection Forensics

In modern cloud environments, static signature detection is incapable of detecting sophisticated identity-based attacks such as session token theft, residential proxy password spraying, or adversary-in-the-middle (AiTM) phishing. Microsoft Entra Identity Protection provides the automated behavioral machine learning (ML) and heuristic telemetry engine that continuously calculates risk scores for every identity and authentication transaction within the tenant.

For the incident responder, Identity Protection telemetry represents an invaluable source of high-fidelity ground truth: revealing leaked credentials found on underground forums, detecting mathematically impossible travel across continents, and identifying stolen session cookies replayed from foreign infrastructure.

This guide provides an exhaustive forensic breakdown of Entra ID Protection architecture, its underlying JSON schemas, detection categories, investigative workflows, and production hunting queries.

---

Concept

Entra Identity Protection partitions risk intelligence into two fundamentally distinct analytical scopes:

graph TD
    subgraph "Entra Identity Protection Dual Architecture"
        AUTH[Authentication Request] --> ENGINE[Risk Evaluation Engine]

        ENGINE -->|Real-time ML Heuristics| S_RISK["1. Sign-in Risk (Transaction Level)<br/>Evaluated at token issuance<br/>Table: AADUserRiskEvents"]

        ENGINE -->|Asynchronous Global Intel| U_RISK["2. User Risk (Identity Level)<br/>Cumulative probability of account compromise<br/>Table: AADRiskyUsers"]

        S_RISK --> DET_RT[Real-time Detections<br/>Anonymous IP, Malicious IP, Suspicious Browser]
        S_RISK --> DET_OFF[Offline Detections<br/>Impossible Travel, Anomalous Token, Leaked Credentials]

        DET_RT --> COND_ACC[Conditional Access Evaluation<br/>Require MFA, Require Password Change, Block]
        DET_OFF --> COND_ACC

        U_RISK --> REMED[Remediation State<br/>atRisk, confirmedCompromised, remediated, dismissed]
    end

1. Sign-in Risk (riskDetections / AADUserRiskEvents)

Represents the probability that a specific, individual authentication request was not authorized by the legitimate account owner. It evaluates contextual signals: source IP reputation, device compliance, client characteristics, and travel velocity.

2. User Risk (riskyUsers / AADRiskyUsers)

Represents the cumulative probability that an identity’s credentials have been compromised. Unlike sign-in risk (which is transient per request), user risk persists over time until explicitly remediated through a secure self-service password reset, administrative reset, or explicit confirmation of compromise.

---

Real-time vs Offline Detections

Understanding the timing mechanism of risk detection is crucial for incident responders to avoid misinterpreting evidence availability:

Detection Type	Processing Mode	Typical Latency	Threat Scenarios & Detection Logic
Anonymous IP Address	Real-time	Instantaneous (< 5s)	Client request originates from a known Tor exit node, commercial VPN, or anonymizing proxy.
Malicious IP Address	Real-time	Instantaneous (< 5s)	IP address actively observed in Microsoft Defender threat intelligence participating in botnets or C2.
Suspicious Browser	Real-time	Instantaneous (< 5s)	Anomalous User-Agent headers, headless automation browsers (Puppeteer, Playwright), or scraping tools.
Unfamiliar Sign-in Properties	Real-time	Instantaneous (< 5s)	Login deviates from the user’s historical baseline (novel device, novel location, novel tenant application).
Impossible Travel	Offline	15 min to 2 hours	Two authentications from geographically distant locations where travel speed exceeds physical feasibility (> 1,000 km/h).
Anomalous Token	Offline	1 to 4 hours	CRITICAL TOKEN THEFT: Token lifetime, issuer properties, or IP context deviates from the token’s original issuance signature.
Token Issuer Anomaly	Offline	1 to 4 hours	Access token presented to a resource was issued by an untrusted or anomalous token service (federation abuse).
Leaked Credentials	Offline	Hours to 48 hours	Microsoft researchers discover valid username/password pairs published on paste sites, dark web markets, or malware logs.
Password Spray	Offline	1 to 4 hours	Global low-and-slow authentication failure patterns matching known threat actor infrastructure.

---

JSON Schema Deep Dive: The Critical Forensic Fields

1. The Risk Detection Schema (/identityProtection/riskDetections | AADUserRiskEvents)

Field Name (Graph API)	Field Name (Log Analytics)	Forensic Significance & Investigative Interpretation
id	Id	Unique GUID for the specific risk detection instance.
requestId	RequestId	Correlates directly with the CorrelationId in SigninLogs to identify the exact authentication attempt.
userId	UserId	Immutable GUID of the affected user object.
userPrincipalName	UserPrincipalName	Identity string of the target user.
riskEventType	RiskEventType	Primary detection classification (e.g., anomalousToken, impossibleTravel, leakedCredentials).
riskLevel	RiskLevel	Severity of the risk detection: low, medium, high, none.
riskState	RiskState	Lifecycle status: atRisk, confirmedCompromised, remediated, dismissed, confirmedSafe.
detectionTimingType	DetectionTimingType	Temporal mode: realtime (evaluated at STS token boundary) or offline (post-auth ML analysis).
activity	Activity	Specific user action that triggered the event: signin, user, servicePrincipal.
ipAddress	IPAddress	Public IP associated with the suspicious transaction.
location	LocationDetails	Geolocation metadata: city, state, country/region, and geographical coordinates.
additionalInfo	AdditionalInfo	Rich diagnostic payload: JSON string containing travel speed (km/h), previous location, or proxy indicators.

2. The Risky Users Schema (/identityProtection/riskyUsers | AADRiskyUsers)

Field Name (Graph API)	Field Name (Log Analytics)	Forensic Significance & Investigative Interpretation
id	Id	User GUID.
userPrincipalName	UserPrincipalName	Account UPN.
riskLevel	RiskLevel	Cumulative risk posture: low, medium, high, none, hidden.
riskState	RiskState	Administrative/system posture: atRisk, confirmedCompromised, remediated, dismissed.
riskDetail	RiskDetail	Explains why the user reached this risk state (e.g., userReportedSuspiciousActivity, aiConfirmedSigninSafe).
riskLastUpdatedDateTime	TimeGenerated	Timestamp of the most recent risk level modification.

---

What Is Possible vs What Is Not Possible

What Is Possible

• Mathematical Travel Verification: Inspecting additionalInfo within impossibleTravel events to calculate the exact distance and calculated velocity between two authentication requests.
• Confirming Stolen Token Replay: Detecting anomalousToken alerts, which provide the strongest cloud-native proof of AiTM cookie theft, PRT extraction, or session replay.
• Auditing Incident Response Actions: Verifying whether a security analyst or administrator explicitly marked an account as confirmedCompromised or prematurely dismissed a valid alert (dismissed).
• Pivoting via RequestId: Seamlessly linking a risk detection record to its exact authentication entry in SigninLogs and downstream operational records in the Purview Unified Audit Log.

What Is Not Possible

• Accessing Telemetry on Entra Free / P1 Tenants: Full Identity Protection telemetry requires Entra ID P2 or Microsoft 365 E5. On Free/P1 tenants, risk levels are masked as “hidden”, and risk detection tables are empty.
• Assuming “No Risk” Equals “No Compromise”: Threat actors operating through localized residential proxies in the victim’s home city frequently evade behavioral ML models; lack of risk telemetry does not prove an account is clean.
• Retroactive Recovery of Unlicensed Risk: Upgrading a tenant from Entra P1 to P2 during an active incident will not generate historical risk records for authentications that occurred prior to license assignment.
• Viewing Data-Plane Activity: Identity Protection analyzes authentication handshakes; it does not log file exfiltration, email forwarding, or database queries.

---

Investigation Methodology: Forensic Extraction and KQL Playbooks

PowerShell Risk Extractor

# ==============================================================================
# Hermes Codex - Entra Identity Protection Forensic Extractor
# Exports Risky Users and Risk Detections via Microsoft Graph API
# ==============================================================================

Import-Module Microsoft.Graph.Authentication, Microsoft.Graph.Identity.SignIns -ErrorAction Stop
Connect-MgGraph -Scopes "IdentityRiskEvent.Read.All", "IdentityRiskyUser.Read.All" -NoWelcome

$OutDir = "./Entra_Risk_$(Get-Date -Format 'yyyyMMdd')"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null

# 1. Extract Risky Users
Write-Host "[*] Extracting Risky Users from tenant..." -ForegroundColor Cyan
$riskyUsersUri = "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers?`$filter=riskLevel ne 'none'"
$riskyUsers = [System.Collections.Generic.List[PSObject]]::new()
do {
    $resp = Invoke-MgGraphRequest -Method GET -Uri $riskyUsersUri
    if ($resp.value) { $riskyUsers.AddRange($resp.value) }
    $riskyUsersUri = $resp.'@odata.nextLink'
    Start-Sleep -Milliseconds 150
} while ($null -ne $riskyUsersUri)

$riskyUsersFile = "$OutDir/RiskyUsers.jsonl"
$riskyUsers | ForEach-Object { $_ | ConvertTo-Json -Compress -Depth 10 } | Set-Content -Path $riskyUsersFile
Write-Host "[+] Exported $($riskyUsers.Count) risky user profiles." -ForegroundColor Green

# 2. Extract Detailed Risk Detections (Last 30 Days)
$DaysBack = 30
$StartDate = (Get-Date).AddDays(-$DaysBack).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ")
Write-Host "[*] Extracting Risk Detections since $StartDate..." -ForegroundColor Cyan

$riskDetectionsUri = "https://graph.microsoft.com/v1.0/identityProtection/riskDetections?`$filter=activityDateTime ge $StartDate"
$riskDetections = [System.Collections.Generic.List[PSObject]]::new()
do {
    $resp = Invoke-MgGraphRequest -Method GET -Uri $riskDetectionsUri
    if ($resp.value) { $riskDetections.AddRange($resp.value) }
    $riskDetectionsUri = $resp.'@odata.nextLink'
    Start-Sleep -Milliseconds 150
} while ($null -ne $riskDetectionsUri)

$riskDetectionsFile = "$OutDir/RiskDetections.jsonl"
$riskDetections | ForEach-Object { $_ | ConvertTo-Json -Compress -Depth 10 } | Set-Content -Path $riskDetectionsFile
Write-Host "[+] Exported $($riskDetections.Count) detailed risk detections." -ForegroundColor Green

# 3. Compute artifact hashes
$h1 = Get-FileHash -Path $riskyUsersFile -Algorithm SHA256
$h2 = Get-FileHash -Path $riskDetectionsFile -Algorithm SHA256
Write-Host "[✓] RiskyUsers SHA-256: $($h1.Hash)" -ForegroundColor Green
Write-Host "[✓] RiskDetections SHA-256: $($h2.Hash)" -ForegroundColor Green

KQL: Anomalous Token Detection

// ==============================================================================
// Detect Anomalous Token Usage (Session Hijacking / Stolen Token Replay)
// MITRE ATT&CK: T1539 - Steal Web Session Cookie
// ==============================================================================
AADUserRiskEvents
| where TimeGenerated >= ago(30d)
| where RiskEventType in ("anomalousToken", "tokenIssuerAnomaly")
| project TimeGenerated, UserPrincipalName, RiskEventType, RiskLevel, RiskState,
          DetectionTimingType, IPAddress, LocationDetails, RequestId, CorrelationId
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated >= ago(30d)
    | project CorrelationId, AppDisplayName, ClientAppUsed, ConditionalAccessStatus
) on CorrelationId
| project TimeGenerated, UserPrincipalName, RiskEventType, RiskLevel, AppDisplayName,
          ClientAppUsed, IPAddress, LocationDetails, ConditionalAccessStatus, CorrelationId
| order by TimeGenerated desc

KQL: Impossible Travel with Velocity

// ==============================================================================
// Investigate Impossible Travel Detections and Parse AdditionalInfo
// ==============================================================================
AADUserRiskEvents
| where TimeGenerated >= ago(30d)
| where RiskEventType == "impossibleTravel"
| extend ParsedInfo = parse_json(AdditionalInfo)
| project TimeGenerated, UserPrincipalName, RiskLevel, RiskState, IPAddress,
          CurrentLocation = tostring(LocationDetails),
          PreviousLocation = tostring(ParsedInfo[0].Value),
          CalculatedSpeedKmh = tostring(ParsedInfo[1].Value),
          CorrelationId
| order by TimeGenerated desc

KQL: Premature Risk Dismissal Audit

// ==============================================================================
// Audit Administrator Dismissals of Risky Users (Potential Admin Error or Tampering)
// ==============================================================================
AuditLogs
| where TimeGenerated >= ago(30d)
| where OperationName in ("Dismiss user risk", "Confirm user compromised")
| mvexpand TargetResources
| extend TargetUser = tostring(TargetResources.userPrincipalName)
| project TimeGenerated, OperationName, TargetUser,
          AdminUPN = tostring(InitiatedBy.user.userPrincipalName),
          AdminIP = tostring(InitiatedBy.user.ipAddress),
          CorrelationId
| order by TimeGenerated desc

---

Investigation Scenario: The Replayed Session Cookie

Intrusion Context

An executive falls victim to an AiTM phishing attack at 09:12 UTC. The adversary extracts the session cookie (ESTSAUTH) from the reverse proxy and replays it from a virtual private server (VPS) located in another country.

Forensic Trail in Identity Protection

1. 09:12:15 UTC - The Interactive Login:
   • The victim authenticates through the phishing proxy. Entra ID sign-in logs record an interactive logon from the proxy IP with ResultType = 0. No immediate risk is flagged because the user satisfied MFA.
2. 09:15:30 UTC - Attacker Token Replay:
   • The attacker injects the session cookie into their local browser and queries Microsoft Graph. A non-interactive sign-in event is logged in AADNonInteractiveUserSignInLogs from a distinct IP (194.26.29.11).
3. 11:42:00 UTC - Offline ML Detection Triggered:
   • Two hours later, Microsoft’s offline token analysis engine compares the token’s internal proof-of-possession characteristics, IP trajectory, and browser fingerprint against the original issuance session.
   • An event is committed to AADUserRiskEvents:
     • RiskEventType: anomalousToken.
     • RiskLevel: high.
     • DetectionTimingType: offline.
     • IPAddress: 194.26.29.11.
   • The user profile in AADRiskyUsers is automatically elevated to riskLevel: high and riskState: atRisk.

Without reviewing Entra Identity Protection’s offline risk telemetry, an investigator inspecting only real-time alerts would completely miss the machine-learning evidence confirming that the session token was hijacked and replayed.

---

The Transversal Doctrine: Risk Telemetry vs Forensic Proof

Risk signals generated by machine learning models must be strictly positioned within the Hermes Codex 7-tier certainty scale:

+-------------------------------------------------------------------------------+
|                      THE 7 LEVELS OF FORENSIC CERTAINTY                       |
|                                                                               |
|  1. Possible     -> Account risk engine configured and licensed (Entra P2).   |
|  2. Configured   -> Risk policies active, Diagnostic Settings streaming.     |
|  3. Authorized   -> Account permissions allow access to targeted services.   |
|  4. Accessible   -> Identity was reachable from external internet / proxies.  |
|  5. Utilized     -> Authentication request processed by Entra STS.            |
|  6. Observed     -> Record appears in AADUserRiskEvents (e.g. anomalousToken).|
|  7. Proven       -> Replay proven by IP jump, impossible travel, and UAL logs.|
+-------------------------------------------------------------------------------+

Critical Forensic Distinctions

1. Observed != Malicious: An impossibleTravel risk event is an observed anomaly calculated by an algorithm. It frequently triggers legitimately when a user connects to a corporate VPN (terminating in Frankfurt) while browsing locally on their mobile device (in Paris) within a 5-minute window.
2. No Risk Observed != Not Compromised: An attacker who obtains stolen credentials and authenticates from a residential proxy within the victim’s same metropolitan area will generate zero risk detections. The absence of an alert does not prove the session was benign.
3. Observed + Correlated == Proven: Proving malicious compromise requires correlating the observed risk event (anomalousToken) with secondary corroborating evidence:
   • Simultaneous conflicting sign-in logs with disparate User-Agents.
   • Unauthorized mailbox forwarding rules (New-InboxRule) created during the flagged session.
   • Confirmation from the user that they were not operating the second device.

---

Common Pitfalls and Traps

Trap	Technical Root Cause	Investigative Impact	Corrective Action
Assuming Dismissing Risk Resolves Incident	Clicking “Dismiss user risk” in the portal resets the risk score to none.	Erases the active alert while leaving the compromised session cookie valid.	Always revoke active sessions (Revoke-MgUserSignInSession) and reset password before clearing risk.
Confusing Sign-In Risk with User Risk	Sign-in risk applies to a single transaction; User risk reflects cumulative account health.	Misconfiguring Conditional Access policies or misunderstanding alert scope.	Treat sign-in risk as immediate containment; treat user risk as root-cause credential remediation.
Expecting Immediate Alerts for Offline Detections	Detections like anomalousToken and impossibleTravel require complex offline ML processing.	Closing an investigation too early and missing high-fidelity alerts that appear hours later.	Re-query Identity Protection telemetry 12 to 24 hours after an incident to catch delayed offline detections.
Ignoring Service Principal Risk Detections	Identity Protection also evaluates workload identities (Service Principals / App Registrations).	Overlooking compromised enterprise applications and automated API abuse.	Query servicePrincipalRiskDetections in addition to human user risk.
Misinterpreting VPN Traffic as Impossible Travel	Users enabling split-tunneling VPNs or mobile private relays trigger false-positive velocity alerts.	Wasting investigative resources chasing legitimate corporate employee network transitions.	Inspect the ISP and ASN of both endpoints before classifying an impossible travel event as an attack.

---

2026 Feature State: Entra Identity Protection

Recent Changes

• Workload Identity Protection Integration: Full risk profiling for Service Principals and Managed Identities, detecting anomalous credential usage and abnormal API query volumes.
• Continuous Access Evaluation (CAE) Integration: When User Risk transitions to high, CAE-capable workloads (Exchange, Teams, SharePoint) instantly terminate active sessions without awaiting access token expiration.
• Unified Graph API v1.0 Endpoints: Complete consolidation of risk detections under /identityProtection/riskDetections and /identityProtection/riskyUsers.

Deprecated Features

• Legacy Identity Risk Events API (/auditLogs/riskDetections beta): Superseded by the dedicated /identityProtection v1.0 API root.
• Standalone Identity Protection Portal: Merged completely into the Microsoft Defender XDR and Microsoft Entra admin centers.

Current Limitations

• Latency of Leaked Credentials Matching: While underground database ingesting is automated, credentials from targeted zero-day stealer logs may take up to 48 hours to be indexed and matched against enterprise user hashes.
• P2 Licensing Boundary: Identity Protection remains strictly gated behind Entra ID P2 / E5 licensing. Tenants with lower license tiers cannot view granular detection reasons or automated risk history.

---

Key Takeaways

1. Identity Protection provides behavioral ground truth: Crucial for identifying stolen session tokens, impossible travel, and leaked dark web credentials.
2. Differentiate real-time from offline detections: Real-time alerts fire instantly; critical detections like anomalousToken can take 2 to 4 hours to appear.
3. Dismissing risk is not containment: Always revoke sessions and reset passwords before updating risk state in the portal.
4. Beware of VPN-induced false positives: Correlate impossible travel velocity with autonomous system numbers and known corporate egress IPs.
5. Zero risk alerts does not equal clean account: Attackers using localized residential proxies intentionally evade machine learning models.

---

References

• Microsoft Entra ID: What is Microsoft Entra Identity Protection?
• Microsoft Graph API: identityProtectionRoot resource type
• Microsoft Learn: How to investigate risk in Microsoft Entra Identity Protection
• Microsoft Learn: Continuous access evaluation in Microsoft Entra