Exam SC-300 Topic 2 Question 234 Discussion

In Azure AD Identity Protection, risk detections are classified into sign-in risks and user risks . According to Microsoft's SC-300 Study Guide and Identity Protection documentation , a user risk represents the probability that an account has been compromised . Microsoft aggregates multiple sign-in signals and applies its threat intelligence algorithms to determine whether a user's identity may be at risk.
Among the listed options, Password spray , Anonymous IP address , and Unfamiliar sign-in properties are sign-in risk detections , while Azure AD threat intelligence is the only type classified as a user risk detection
.
Microsoft Docs states: "User risk detections are generated by Azure AD threat intelligence when Microsoft detects that user credentials appear to be compromised."