What a risky sign-in is and is not
Microsoft Entra ID scores sign-ins for risk: unusual location, unknown device, anonymous IP address, or signals around leaked credentials. A “risky sign-in” means: this fits the user’s normal pattern less well. It does not automatically mean the tenant was taken over — and it also does not mean you may ignore every alert.
Without someone who sees alerts and follows a short checklist, the signal disappears in the portal. Risky sign-ins therefore belong next to alert policies and an agreement on who responds — not as a standalone dashboard nobody opens.
What an SME should investigate
Keep it short enough to actually do this quarter:
- Who and when — which account, which time, which country or network?
- Did multifactor authentication succeed? — a failed or bypassed second factor weighs heavier than a successful Authenticator step by the employee themselves.
- Does it fit the work? — travel, working from home, a new laptop, or a partner signing in on someone’s behalf?
- Follow-up — password reset, end sessions, temporarily block the account, or only document that it was legitimate.
Do not wait until “something somewhere looks wrong”. A clear investigation line stops every alert from becoming panic — and stops real signals from being left behind. See also Conditional Access: stricter access rules often reduce repeated risky sign-ins.
Alerts, MFA and break-glass accounts
Risky sign-ins only help if someone sees them. Set alerts so Floor ICT or your internal contact gets a ticket or email — not only an icon in the admin portal. Ensure multifactor authentication is on for staff; without a second factor, “risky” is harder to assess and easier to abuse.
Document how break-glass accounts stay outside normal triage (or are watched more closely on purpose), so a stricter response does not lock the tenant. Name who may block an account and who may reset a password.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: surface risky sign-ins and Identity Protection signals where your licences allow; link them to alerts or tickets; and give a short first-assessment workflow. We help distinguish legitimate travel from a reset-worthy event — unless you deliberately keep that assessment in-house.
You still decide: who may block or reset, how strictly you respond to “medium” versus “high” risk, whether staff get a short explanation, and whether every signal may become a Floor ICT ticket. The MSP package does not automatically mean risky sign-ins are actively watched; that is a separate agreement and tenant configuration next to Essential, Advanced or Elite.
More depth
Checklist for SME directors
1) Confirm MFA is on for staff. 2) Turn on alerts for risky or suspicious sign-ins. 3) Assign one owner for first assessment. 4) Document: when to reset, when to block, when only to note. 5) Review after two weeks for too many false alarms — not everything at once.
Risky versus compromised
Microsoft may mark a user or sign-in as compromised or high risk. Treat that more strictly than a one-off unusual location: end sessions, reset the password, re-register MFA where needed. Floor ICT helps with the steps; you or the process owner decide on blocking.
Licences and expectations
Deep Identity Protection insight depends on Microsoft licences (for example Microsoft Entra ID P2 features). Floor ICT says at intake what is visible in your tenant without promising a large security programme. No promises of “zero risky sign-ins” — yes to visible signals with an owner.