Risky Sign-In Signals and Anonymized Infrastructure
Short answer
The main risky sign-in signals are an anonymous IP address (for example Tor or an anonymous VPN), a sign-in with unfamiliar properties such as a new IP, ASN, device or location, atypical or impossible travel, a malicious or threat-actor IP, password spray and token anomalies. Microsoft Entra ID Protection lists all of these as risk detections. No single signal proves compromise, so combine them and respond with step-up authentication, a session revoke or a block.
Last reviewed 4 November 2026. Limits and terms were read on each provider’s own page that day and can change; check the page before you build on them.
Sign-in risk detections in Microsoft Entra ID Protection
| Signal | What it means (per Microsoft) | Real-time or offline | Licence |
|---|---|---|---|
| Anonymous IP address | Sign-in from an anonymous IP such as the Tor browser or an anonymous VPN, typically used to hide IP, location and device | Real-time | Entra ID Free or P1 |
| Unfamiliar sign-in properties | Properties such as IP, ASN, location, device, browser or tenant IP subnet that are new for this user; off during a learning period of at least five days for new users | Real-time | Entra ID P2 |
| Atypical travel | Two sign-ins from distant locations, at least one atypical for the user, given the time between them | Real-time | Entra ID P2 |
| Malicious IP address | Sign-in from an IP judged malicious from high failure rates from invalid credentials or other IP reputation sources | Offline | Entra ID P2 |
| Verified threat actor IP | Activity consistent with IPs linked to nation-state or cybercrime groups, from Microsoft Threat Intelligence Center data | Real-time | Entra ID P2 |
| Password spray | Microsoft observed a spray attack and the attacker successfully validated a user’s password; failed attempts do not trigger it | Real-time or offline | Entra ID P2 |
| Anomalous token | Unusual token lifetime or a token played from an unfamiliar location, a possible token replay; noisier at low and medium risk | Real-time or offline | Entra ID P2 |
| Suspicious MFA authentication approval | Unfamiliar properties during a password plus MFA sign-in, with Authenticator telemetry, that suggest social engineering or phishing | Real-time | Entra ID P2 |
Anonymized infrastructure is a signal, not a verdict
Tor exits, anonymous VPNs and residential proxy networks hide where an attacker really is, which is why identity systems score them. They also carry legitimate privacy users, so treat an anonymous IP as a reason to raise friction (step-up authentication, a managed-device requirement) rather than to block automatically.
Okta’s behavior detection works from a different angle: its docs list new city, state, country and geo-location, new device, new IP, new ASN and a velocity check between two successive sign-ins. The Okta page does not mention anonymizers, proxies or VPNs, so check how your own provider handles them.
What to do when several signals stack
A sign-in that is both from an anonymous IP and has unfamiliar properties, or that follows a successful password spray, deserves a stronger response than either alone. Common responses are require phishing-resistant MFA, revoke sessions and refresh tokens, reset the password and review recent mailbox rules and new MFA methods.
Review the account afterwards for new authentication methods and inbox forwarding rules, which are common follow-on steps after takeover.
Practise the decisions
The labs below let you triage realistic sign-in events and choose allow, step up or block, with no real tenant needed.
Try it on PlayCISO
Triage sign-in risk events and decide allow, step-up or block.
ITDR LabIdentity threat detection and response: impossible travel, MFA fatigue, token abuse and more.
MFA Bypass LabPush fatigue, SIM swap, token theft and adversary-in-the-middle incidents.
Step-Up Authentication LabDecide when risk justifies a challenge.
Credential Stuffing LabMatch defenses to stuffing and spray attacks.
Token Lifecycle LabTriage OAuth and OIDC token setups.
Frequently asked questions
What are risky login signals?
Signals identity systems use to score a sign-in as suspicious: an anonymous IP such as Tor, unfamiliar properties (IP, ASN, device, location), atypical travel, a malicious or threat-actor IP, password spray and token anomalies. Microsoft Entra ID Protection documents each as a risk detection.
Is a sign-in from Tor or a VPN always malicious?
No. Microsoft describes anonymous IPs as typically used by actors who want to hide their sign-in details for potentially malicious intent, but privacy users also use them. Raise friction instead of blocking automatically.
Do I need a premium licence to see these detections in Entra?
Per Microsoft, the anonymous IP address detection is available with Entra ID Free; full details on most other detections need Entra ID P2, and without it you see only an Additional risk detected entry.
What should I do when several risky signals appear together?
Respond more strongly than for a single signal: require phishing-resistant MFA, revoke sessions and tokens, reset the password and check for new MFA methods and inbox rules.