Entra Identity Protection

A risk-based engine that detects suspicious sign-ins and compromised users by analyzing signals such as atypical travel, leaked credentials, and malware-linked behavior. Automated responses can require MFA, forced password reset, or block access