Citrix Analytics for Security

Microsoft Graph Security risk indicators

June 18, 2024

Contributed by:

C M R

Note:

Since July 2023, Microsoft has renamed Azure Active Directory (Azure AD) to Microsoft Entra ID. In this document, any reference to Azure Active Directory, Azure AD, or AAD now refers to Microsoft Entra ID.

Microsoft Graph Security receives data from the Azure AD Identity Protection or Microsoft Defender for Endpoint security providers, and sends the information to Citrix Analytics.

Azure AD Identity Protection triggers the following risk indicators and sends the information to Microsoft Graph Security:

Anonymous IP address
Impossible travel to atypical locations
Users with leaked credentials
Sign-ins from infected devices
Sign-ins from IP addresses with suspicious activity
Sign-ins from unfamiliar locations

For information about Defender for Endpoint, see Microsoft Defender for Endpoint.

The risk factor associated with the risk indicators is the IP-based risk indicators. For more information about the risk factors, see Citrix user risk indicators.

How to analyze Microsoft Graph Security risk indicators

Consider a user Maria Brown who exhibits one of the risky behaviors mentioned previously. Microsoft detects the incident and generates an alert. Citrix Analytics retrieves this alert and assigns an updated risk score to Maria Brown. Also, the appropriate risk indicator is added to Maria Brown’s risk timeline.

To view the Microsoft Graph Security risk indicator entry for a user, navigate to Security > Users, and select the user.

From Maria’s timeline, you can select the latest risk indicator entry from the risk timeline. Its corresponding detailed information panel appears in the right pane. The WHAT HAPPENED section provides a brief summary of the risk indicator.

How to get more information about the risk indicators

For more information, see Azure Active Directory risk events.

What actions you can apply to the user

Currently, the ability to take appropriate actions on the user’s account through the Microsoft Graph Security data source is not available.

For information on Microsoft Graph Security onboarding, see Microsoft Graph Security.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Microsoft Graph Security risk indicators

June 18, 2024

Contributed by:

C M R

June 18, 2024

Contributed by:

C M R

Microsoft Graph Security risk indicators

How to analyze Microsoft Graph Security risk indicators

How to get more information about the risk indicators

What actions you can apply to the user

In this article