Microsoft Entra ID Protection
FundamentalsWhat are risk detections?
In brief
The documentation now lists the `suspiciousCredentialAddition` risk event type instead of `TBD` and revises the detection description. Metadata and customer intent were also updated.
What Entra admins need to know
Administrators can use the documented event type to identify this detection; no action is required.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
What are risk detections?
| Microsoft Entra threat intelligence (user) | Real-time or Offline | Nonpremium | investigationsThreatIntelligence |
| Possible attempt to access Primary Refresh Token (PRT) | Offline | Premium | attemptedPrtAccess |
| Suspicious API Traffic | Offline | Premium | suspiciousAPITraffic |
| Suspicious credential addition | Real-time | Premium | TBDsuspiciousCredentialAddition |
| Suspicious sending patterns | Offline | Premium | suspiciousSendingPatterns |
| User reported suspicious activity | Offline | Premium | userReportedSuspiciousActivity |
Suspicious credential addition
This detection identifies when a new authentication method is added to an account under suspicious circumstances. This activity might indicate that an attacker has accessed the account and is trying to maintain access by registeringregistered a new credential.
Microsoft Entra ID Protection raises user risk when this activity is detected, allowing organizations to respond through their configured risk-based policies.
- Calculated in real-time
- License requirement: Microsoft Entra ID P2
@@ -3,10 +3,12 @@ title: What are risk detections? description: Explore the full list of risk detections and their corresponding risk event types, along with a description of each risk event type. ms.service: entra-id-protection ms.topic: reference-ms.date: 10/19/2026+ms.date: 10/21/2026 ms.reviewer: lvandenende ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1030++#customer intent: As an administrator, I want to understand Microsoft Entra ID Protection risk detections so that I can identify suspicious activity in my organization. --- # What are risk detections?@@ -63,7 +65,7 @@ Select a risk detection from the list to view the description of the risk detect | [Microsoft Entra threat intelligence (user)](#microsoft-entra-threat-intelligence-user) | Real-time or Offline | Nonpremium | investigationsThreatIntelligence | | [Possible attempt to access Primary Refresh Token (PRT)](#possible-attempt-to-access-primary-refresh-token-prt) | Offline | Premium | attemptedPrtAccess | | [Suspicious API Traffic](#suspicious-api-traffic) | Offline | Premium | suspiciousAPITraffic |-| [Suspicious credential addition](#suspicious-credential-addition) | Real-time | Premium | TBD |+| [Suspicious credential addition](#suspicious-credential-addition) | Real-time | Premium | suspiciousCredentialAddition | | [Suspicious sending patterns](#suspicious-sending-patterns) | Offline | Premium | suspiciousSendingPatterns | | [User reported suspicious activity](#user-reported-suspicious-activity) | Offline | Premium | userReportedSuspiciousActivity | @@ -303,11 +305,7 @@ This risk detection is reported when abnormal GraphAPI traffic or directory enum ### Suspicious credential addition -<!-- TODO: Confirm the Premium license requirement and replace the TBD riskEventType in the user risk detections table before publishing. -->--This detection identifies when a new authentication method is added to an account under suspicious circumstances. This might indicate that an attacker has accessed the account and is trying to maintain access by registering a new credential.--Microsoft Entra ID Protection raises user risk when this activity is detected, allowing organizations to respond through their configured risk-based policies.+This detection identifies when a new authentication method is added to an account under suspicious circumstances. This activity might indicate that an attacker has accessed the account and registered a new credential. - Calculated in real-time - License requirement: Microsoft Entra ID P2