#HOME PROTECTOR USERS MANUAL PASSWORD#

Administrators may determine that extra measures are necessary like blocking access from locations or lowering the acceptable risk in their policies. Some detections may not raise risk to the level where a user self-remediation would be required but administrators should still evaluate these detections.

Users must have previously registered for Azure AD MFA and SSPR for use when risk is detected. These detections are then considered closed.

#HOME PROTECTOR USERS MANUAL PASSWORD#

If you allow users to self-remediate, with Azure AD Multi-Factor Authentication (MFA) and self-service password reset (SSPR) in your risk policies, they can unblock themselves when risk is detected. If using continuous access evaluation, revoke all access tokens.įor more information about what happens when confirming compromise, see the section How should I give risk feedback and what happens under the hood?.Disable any devices considered compromised.Block the user if you suspect the attacker can reset the password or do multi-factor authentication for the user.If a risk policy or a Conditional Access policy wasn't triggered at part of the risk detection, and the risk wasn't self-remediated, then:.Select the event or user in the Risky sign-ins or Risky users reports and choose 'Confirm compromised'.If the account is confirmed compromised:.Close individual risk detections manually.

Some risks detections may be marked by Identity Protection as 'Closed (system)' because the events were no longer determined to be risky.Īdministrators have the following options to remediate: As an administrator, you want to get all risk detections closed, so that the affected users are no longer at risk. The user risk level is an indicator (low, medium, high) for the probability that an account has been compromised.

RemediationĪll active risk detections contribute to the calculation of a value called user risk level. Microsoft recommends closing events quickly, because time matters when working with risk. Organizations should try to close all risk detections that they're presented in a time period your organization is comfortable with. Organizations can enable automated remediation using their risk policies. After completing your investigation, you need to take action to remediate the risk or unblock users.

Home protector users manual