Sign-In Risk vs. User Risk in Microsoft Entra ID: What is the Difference?

Sign-in risk and user risk in Microsoft Entra ID Protection are distinct security metrics. Sign-in risk evaluates whether a single authentication attempt is suspicious, while user risk determines if an account's core credentials have been compromised across multiple sessions.

Understanding the Core Distinction

When administrators first deploy Microsoft Entra ID Protection, one of the most common points of confusion is mixing up sign-in risk with user risk. While both metrics rely on Microsoft's massive signal intelligence network—analyzing trillions of daily signals across consumer accounts, enterprise tenants, and even Xbox services—they answer fundamentally different questions.

A security system cannot treat a single unusual login the same way it treats a fundamentally stolen account. If an administrator applies a blanket account lockout every time someone logs in from an unfamiliar location or an unexpected network, productivity grinds to a halt. Conversely, treating a genuinely compromised account with a simple temporary MFA challenge leaves the persistent threat actor free to log back in later once the challenge expires. Understanding how these two metrics function independently, and how they interact, is essential for designing a balanced cloud security posture.

What Is Sign-In Risk?

Sign-in risk focuses exclusively on a single moment in time: the exact instant a user attempts to access a resource like Microsoft Teams, SharePoint, or Outlook. It is entirely about the specific context of that individual login attempt and nothing else. The system asks whether the properties of this specific request match the normal behavioral patterns of the user.

Microsoft Entra ID Protection evaluates several variables during real-time sign-in checks. These include connections originating from anonymous IP addresses often used to obscure geographic locations, impossible travel scenarios where sign-ins occur from geographically distant regions in an unrealistic timeframe, or signs of a password spray attack where an adversary tests a single common password across thousands of enterprise accounts simultaneously. Unfamiliar sign-in properties are also graded dynamically; the more unusual the request looks compared to historical baselines, the higher the risk score climbs.

Crucially, a sign-in risk score belongs strictly to that one attempt. If a user successfully passes a step-up multi-factor authentication prompt during that specific login, the risk associated with that sign-in is immediately neutralized, and the user carries on with their day without any ongoing penalty to their account status.

What Is User Risk?

User risk, by contrast, is not about a single login. It is about the health and integrity of the account itself. User risk asks whether the account's credentials have fallen into unauthorized hands, meaning an adversary possesses the permanent keys to the kingdom and can return to compromise data whenever they choose.

The primary driver of user risk is the appearance of credentials in known data breaches. When usernames and passwords are leaked on the dark web or harvested via info-stealing malware, Microsoft's threat intelligence flags those credentials immediately. Other indicators include verified threat actor infrastructure interacting directly with the user profile or anomalous activity patterns that suggest persistent unauthorized access.

When an account is flagged for user risk, the threat remains even after the user logs out. Because an attacker may have obtained the password outside of normal session bounds, simply challenging the user with MFA is rarely enough to fully resolve a high user risk score. The underlying vulnerability must be addressed.

How Risk Levels Are Calculated

Both sign-in risk and user risk boil down to three clear confidence levels: low, medium, and high. These levels represent machine learning estimations of threat probability rather than absolute binary truths.

High risk indicates that Microsoft's automated systems possess strong, verified proof of compromise, such as explicit leaked credentials matching dark web databases or verified malicious IP signatures. Medium risk reflects moderate signs of suspicious activity with lower absolute confidence. Low risk points to anomalous behavior that deviates from standard patterns but lacks definitive malicious indicators.

An important administrative detail is how these records age over time. Low-risk items automatically age out after roughly six months to keep dashboards clean and manageable. Medium and high-risk items, however, do not age out on their own. They persist in the admin center until an automated policy or human administrator explicitly investigates, remediates, or dismisses them.

The Rollover Effect: How They Interconnect

While sign-in risk and user risk evaluate different things, they are tightly coupled in reporting and enforcement. A single sign-in risk that goes completely unaddressed or unverified can roll up and compound over time, ultimately adding to the overall user risk score.

This means an individual can appear as a risky user in the Entra ID dashboard even if their most recent login attempts appeared entirely normal. The system recognizes a cumulative history of suspicious behavior that elevates the probability of long-term compromise. IT administrators must examine both reports concurrently rather than treating them as isolated silos.

Automating Remediation Through Conditional Access

To prevent security teams from drowning in manual alerts, Microsoft Entra Conditional Access bridges the gap between risk scores and automated enforcement. Organizations can configure specific policies that trigger when low, medium, or high risk thresholds are crossed.

For sign-in risk, policies can enforce actions such as requiring MFA, forcing a new sign-in session, or blocking access entirely. When a user successfully satisfies an MFA challenge, the risk is remediated on the spot.

For user risk, policies typically require a secure password change or automated risk remediation. The smart part of risk remediation is its adaptability: if the user signs in with a traditional password, the system demands a secure password change and immediately invalidates all existing sessions. If the user signs in via passwordless methods, it cuts off active sessions and prompts a fresh authentication flow. This automated response dramatically reduces help desk ticket volume while stopping attackers in their tracks.

Conclusion

Mastering the distinction between sign-in risk and user risk allows cloud architects to build precise, nuanced security policies that protect corporate data without causing excessive friction for everyday users. By letting automation handle common remediation tasks, IT teams can focus their energy on investigating genuine threats. To dive deeper into how these protection layers operate in modern cloud environments, Listen to the full episode of the podcast for a complete breakdown of configuration best practices, licensing requirements, and real-world administration strategies.