Microsoft Entra ID risk level is now available in near real time in Microsoft Defender for Identity (Preview)
Analysis / inference: Microsoft Defender for Identity now provides near real-time Entra ID risk levels in the IdentityInfo table and identity UI components.
- Dates
- Source and collection dates not recorded
- Source
- Microsoft Defender for Identity - What's new archive · Limited verification
- Classification
- Microsoft Security
Section 01 · Summary analysis
The Microsoft Entra ID risk level is now updated in near real time directly through Defender for Identity, replacing the previous UEBA-based synchronization method for licensed tenants.
AI summary / analysis; claims are not independently verified. Check the primary source before acting.
Section 02 · Analysis
SecOps Signal analysisIntegrating near real-time Entra ID risk levels into Defender for Identity enhances the fidelity of identity-based investigations and enables more responsive custom detection logic for high-risk users.
SOC analysts gain improved context for identity investigations and the ability to create more timely custom detections based on current user risk.
Section 03 · Recommended actions
- Update hunting queries to leverage the near real-time risk level data.
- Review and adjust custom detection rules that utilize user risk scores.
- Monitor the Identity Inventory page for new risk-based insights.
- Verify the IdentityInfo table in Advanced Hunting for the updated risk level fields.
- Review existing custom detection rules that rely on user risk scores for potential optimization.
- Check the Identity Inventory and identity details pages for the new risk score visibility.