Risky sign-ins
Risky sign-ins are authentication attempts that Microsoft Entra ID Protection flags as suspicious, such as sign-ins from anonymous IPs, atypical travel, or leaked credentials.
Risk-based Conditional Access policies can automatically require MFA or block sign-ins detected as risky.