About Azure Active Directory Identity Protection notifications

Question

Dear Experts,

Can we send Users at risk detected emails in Azure AD to risked users too?

https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-configure-notifications#:~:text=Users%20at%20risk%20detected%20email,investigate%20the%20users%20at%20risk.

We receive this alerts, but can we do something to get risky users receive it too and add us to CC? If it is possible, it will be good to start a contact with the risky user.

Thank you very much..

Answer 1

Hi @Mehmet Cüneyt Durgun ,

The Azure Active Directory Identity Protection notifications feature is intended to notify Administrators about the risk event so that they can apply security policies on the risky users to protect their accounts. For example, administrator can configure policy for triggering MFA if medium or high risk is detected for all users or a specific set of users. Administrators can also fetch details of the risky users from Azure AD and contact them to confirm if a given alert is false positive, for instance.

As of now, there is no mechanism in place to send an email notification to the risky user account itself. You can post this idea at our feedback portal with your business requirement. This portal is monitored by the product team and they can add it to their future roadmap of the product.

-----------------------------------------------------------------------------------------------------------

Please do not forget to "Accept the answer" wherever the information provided helps you. This will help others in the community as well.