Weekly digest says new risky sign-ins detected, but nothing in risky sign-ins report

Question

I received the usual Azure AD Identity Protection Weekly Digest email today, but this time it said that 7 new risky sign-ins were detected:

If I click on the link, it takes me to the "Risky sign-ins" report in the Azure portal, set up to show all risky sign-ins in the last 7 days. But this shows "No sign-ins found":

Expanding the report to the last month doesn't show anything either. There's also nothing in the "Risk Detections" report.

So: Were there risky sign-ins or not? If there were, how can I see what the issue was?

Thanks!

Answer 1

@Richard Bowmaker

Can you try following :

1. Clear the risk state filter and check the risk detection blade.
2. If the above does not show any events, open a support ticket to investigate if those sign ins were dismissed by someone else or it might be a false positive.

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community

Answer 2

I have the same problem. Is there already a solution to this?

Answer 3

Hello
i have this issue for 1 month now.
do you have any solution for that.
Thx

Answer 4

Also seeing this same issue.

Answer 5

I have really bad news, everyone... I'm sorry for the delay in getting back to you all, but I finally got an OFFICIAL response from Microsoft. It pissed me off pretty bad, which led me to "give up" on this issue, but that's no excuse for taking this long to share the OFFICIAL (all caps out of frustration) response from Microsoft.

Below are two different e-mails from MS. My response to this was: "Oh no… So after being falsely notified of a potential threat once or twice a week, I’m going to become numb to thinking they’re noise… and then a real attack will happen one day and I won’t know about it because of all the false alarms Microsoft sent, subconsciously training me to ignore security. I cannot fathom how Microsoft would consider this “by design”." They never replied back after that, and nor did I expect them to. --Matt

---> Dec 14, 2023:

Subject: RE: [EXTERNAL] RE: 9 Risky Sign-Ins in Alert, b... - TrackingID#2310190040015423

Hi Matt,

I called you and left a VM. Thank you very much for your patience during the course of this ticket.

I've got a position from the backend team in regards of your case. Those weekly digest (real-time) entries that you're receiving can be safely ignored, as they're false positives being automatically mitigated by the Azure AI.

By system design, they will be listed in the weekly digest, but the risky detections that will need your attention will be shown in your Azure Portal's Security page.

If you feel that this feature or service may be misleading and would like to make a suggestion for improvements, I invite you to post your suggestion directly in the official Azure feedback page, where (sometimes) the Microsoft Engineers responsible for deploying those technologies can directly reply to those suggestions:

Ideas · Community (azure.com)

If you have any further questions, let me know and I will be happy to assist you. Looking forward for your reply,

Thanks, Rondinelli Microsoft 365 Azure Support Ambassador

---> Dec 18, 2023:> > Hello Matt,   > > This is Rohit from Microsoft Azure Support. I'll be handling your support request as Rondinelli is out of office.> > As Rondinelli mentioned, the weekly digest (real-time) entries that you're receiving can be safely ignored, as they're false positives. As this is by design you can disable the weekly digest emails and still receive user risk alerts emails. > > When there would be an actual risk, you would receive an email informing that there are users at risk similar to the one below.> >

If you feel that this feature or service may be misleading and would like to make a suggestion for improvements, please post your suggestion directly in the official Azure feedback page, where (sometimes) the Microsoft Engineers responsible for deploying those technologies can directly reply to those suggestions:
 
https://feedback.azure.com/d365community
 
If you have any further questions, let me know and I will be happy to assist you.> Waiting for your response, > Thank you, >  > Rohit > Microsoft Azure Support Engineer