Unit 6: Monitor, Investigate, and Remediate Risks

Identity Protection Reports

Three primary reports exist.

Each report supports:

• Filtering.
• Downloading.
• Detailed investigation.

Risky Users Report

Used to:

• Identify compromised users.
• View risk history.
• Take remediation actions.

Available actions:

• Reset password.
• Confirm compromise.
• Dismiss user risk.
• Block sign-in.

Risky Sign-ins Report

Shows:

• Risk levels.
• Detection types.
• Device and location data.
• Conditional Access results.

Critical for policy tuning.

Risk Detections Report

Shows:

• Individual detection events.
• Correlated detections.
• Links to Defender for Cloud Apps.

Some detections auto-close when Microsoft confirms them safe.

Risk Remediation Options

Administrators can remediate risk through:

• Automated self-remediation.
• Manual password reset.
• Dismissing user risk.
• Closing detections manually.

Best practice:

Always bring the identity back into a safe state.

Unblocking Users

Blocked users can be unblocked by:

• Resetting passwords.
• Dismissing user risk.
• Adjusting exclusions.
• Disabling policies temporarily.