Microsoft Entra ID Protection: risky users and sign-ins, confirm user compromised, revoking sessions; MFA fatigue response

Microsoft Entra ID Protection uses signals from Microsoft's identity systems to judge how likely it is that a sign-in or an account is compromised. It has two kinds of risk. Sign-in risk is the probability that a particular sign-in was not made by the account owner, for example from an anonymous IP address, an unfamiliar location, or a token that looks replayed. User risk is the probability that the account itself is compromised, for example because its credentials were found leaked, or because of a pattern of risky sign-ins. Risk levels are low, medium and high. Some detections are real-time, calculated during sign-in, and others are offline, calculated afterward.