Free tools Windows power users keep installed
One-click scans. No signup required.
Start in Microsoft Entra ID Protection, not in the user’s mailbox. Open Protection > Identity Protection > Risky sign-ins or Risky users, inspect the event against the user’s normal activity, and decide whether it is expected or unauthorized.
If the activity is unauthorized, contain it immediately: mark the sign-in or user as compromised, force a secure password reset, block the account when an attacker may still control the password or authentication methods, and revoke refresh tokens and sessions. Then check audit and sign-in logs for persistence such as new app registrations, mailbox rules, privilege changes, or altered authentication methods.
As an Amazon Associate I earn from qualifying purchases.
What to do in the first 15 minutes
A risky sign-in is an investigation signal, not proof that an account has been taken over. Microsoft Entra risk detections can be triggered by unfamiliar locations, anonymizing networks, leaked credentials, atypical travel, new devices, or unusual application behavior. Treat the alert seriously, but base the response on the evidence in the event and the user’s legitimate work pattern.
Recommended Free Tools
- Open the risk event. In the Microsoft Entra admin center, go to Protection > Identity Protection > Risky sign-ins. For an account-level view, use Protection > Identity Protection > Risky users.
- Record the evidence before changing anything. Note the application, IP address, approximate location, user agent, device information, authentication result, and time. Capture the event or export the relevant log entry according to your organization’s evidence-retention policy.
- Compare it with known behavior. Check travel schedules, approved VPN or proxy egress addresses, managed-device records, working hours, and the application the user normally uses.
- Contain first when the evidence points to an attacker. Mark the event or user as compromised, reset the password through a trusted administrative path, revoke sessions and refresh tokens, and block the account if the attacker may still be able to sign in or complete a password or MFA operation.
- Look for follow-on changes. Review audit and sign-in logs for authentication-method edits, app registrations or consent, mailbox-rule changes, role assignments, and access to sensitive resources.
Do not wait for a complete forensic explanation before revoking access. You can preserve the logs and continue investigation after the attacker’s active sessions have been invalidated.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to investigate a risky sign-in in Entra ID Protection
1. Inspect the event details
Open the individual risky-sign-in record and read the full detail pane. Confirm which user, application, resource, authentication flow, and client were involved. A familiar user name does not make the event safe: an attacker can use a stolen session or token while presenting the correct account.
- Application and resource: An unexpected cloud application, legacy protocol, or sensitive resource deserves more scrutiny than a normal sign-in to the user’s routine service.
- IP address and location: Compare the address with corporate egress, a known VPN, a mobile carrier, or a user’s actual location. Geolocation is approximate and can be wrong, so it is supporting evidence rather than a verdict.
- User agent and device: Look for a browser, operating system, or device that the user does not recognize. Check whether the device is registered, compliant, or present in endpoint-management records.
- Timing: Compare the event with the user’s work schedule, travel, and other successful sign-ins. A rapid sequence from distant locations is more concerning when the locations cannot be explained by a proxy or VPN.
- Authentication result: Determine whether MFA was completed, rejected, bypassed through an older protocol, or satisfied by an existing token. A successful MFA result does not prove that the person at the keyboard was the legitimate user.
2. Review the user’s sign-in history
Search for successful and failed attempts before and after the alert. Look for repeated password failures, unfamiliar applications, impossible timing, a new device followed by access to sensitive data, or a change from interactive sign-in to non-interactive token use. Correlate the time with help-desk reports, endpoint alerts, and the user’s own confirmation.
3. Use the risk state correctly
Identity Protection reports several states. The state is an administrative conclusion about the event, not a replacement for the underlying evidence.
| State | Meaning | What an administrator should do |
|---|---|---|
| At risk | The detection needs investigation or has not yet been remediated. | Inspect the event and related activity; contain it if unauthorized. |
| Confirmed compromised | You have determined that the sign-in or user was unauthorized. | Complete password, session, authentication-method, and persistence remediation. |
| Confirmed safe | The activity was verified as legitimate. | Document why it was expected and keep relevant evidence. |
| Dismissed | The risk was closed without treating it as a confirmed compromise. | Use only when the available evidence supports dismissal and no remediation is required. |
| Remediated | The required user action or administrative response has addressed the risk. | Verify that access is restored safely and that no related changes remain. |
Microsoft’s operational guidance is to continue investigating after containment when necessary: “Once the risk is contained, more investigation might be required to mark the risk as safe, compromised, or to dismiss it.”
How to contain a confirmed compromised account
1. Mark the risk as compromised
In Risky sign-ins or Risky users, select the event or user and choose the action that records a confirmed compromise. This preserves the security decision in the identity system and helps later reporting and policy evaluation.
2. Reset the password through a trusted path
Force a secure password reset rather than asking the user to reuse a familiar password. If the user can still reach a known-clean device and complete your approved self-service process, use secure password change or SSPR. Otherwise, an administrator should reset the password and require a change at the next sign-in.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not send a new password through the same potentially compromised mailbox or chat session. Verify the user through an independent channel and make sure the replacement password is unique to the organization’s account.
3. Block the account when access may still be active
Temporarily block sign-in if the attacker may still know the password, can approve MFA prompts, controls a registered device, or has another way to complete authentication. Blocking is especially urgent for a privileged account or an account with access to sensitive data. Coordinate the block with business owners so a critical workload is not left without an approved operator.
4. Revoke refresh tokens and sessions
Password changes do not reliably terminate every already-issued session. Revoke the user’s refresh tokens and active sessions after the password reset, then verify that browser sessions, mobile clients, and other applications require fresh authentication. Ask the user to close all browser windows and remove unfamiliar devices from their account as an additional precaution.
5. Re-check authentication methods
Review the account’s registered authentication methods. Remove unfamiliar phone numbers, email addresses, authenticator registrations, passkeys, or security keys, and require the user to register trusted methods again. An attacker who added a method can regain access even after a password reset unless that method is removed.
6. Investigate leaked credentials
For a leaked-credential detection, determine whether the exposed password was still in use and whether the user changed it before the alert. If unauthorized access occurred, Microsoft’s guidance is to block the user, reset the password, and revoke refresh tokens. Continue by checking for persistence and data access rather than treating the password operation as the complete recovery.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How to decide whether an alert is legitimate
Expected travel, a company VPN, a new office, or a newly issued device can create a risk signal. Ask the user through a verified channel whether they initiated the sign-in and whether the application, device, and time are plausible. Confirm the device and network independently; do not accept a reply from an account session that may belong to an attacker.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
If the evidence supports legitimate activity, record the explanation and use the appropriate action to confirm the sign-in as safe or dismiss the risk. Do not clear an alert solely because the user passed MFA or because the IP geolocation looks familiar. A stolen token, an approved MFA prompt, or a compromised device can all produce a technically successful sign-in.
Use risk-based Conditional Access for automatic response
Risk-based Conditional Access can turn the investigation decision into a repeatable control. A policy can require MFA for a risky sign-in, require a secure password change for high user risk, or block access when the risk is too high. The policy does not replace incident investigation; it reduces the time between detection and a safe challenge.
| Risk signal | Typical control | When it fits |
|---|---|---|
| Sign-in risk | Require MFA or block access | The particular authentication attempt looks unusual, but the user account is not necessarily compromised. |
| High user risk | Require secure password change through SSPR, or block | Indicators suggest that the account’s credentials may be exposed or the user identity has been compromised. |
| Confirmed compromise | Administrative containment plus blocking | An investigation has established unauthorized activity or an attacker may still control access. |
Prerequisites before enforcement
- MFA registration: Users must have an approved method that they can use when the policy challenges them.
- SSPR and secure password change: Configure and test the self-service flow before requiring it for high user risk.
- Emergency-access accounts: Maintain at least one tested break-glass path that is excluded from ordinary enforcement and monitored closely.
- Policy staging: Start in report-only or a carefully scoped pilot, review sign-in results, and then expand the assignment.
- Administrator exclusions: Make sure the people who administer identity and Conditional Access can use the approved emergency procedure if a policy behaves unexpectedly.
Register phishing-resistant methods before enabling a policy that requires them. A new policy must not be the first time an administrator discovers that their account has no usable method or that a critical service cannot satisfy the control.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Check for persistence and lateral movement
After containment, review the audit and sign-in records for changes made during the suspected compromise window. Resetting the password is insufficient if the attacker established another route back into the tenant.
Authentication-method changes
Look for newly added phone numbers, authenticator devices, passkeys, security keys, or alternate email addresses. Remove every method that the user does not recognize, and require fresh registration on a known-clean device.
Application registrations and consent
Search for new app registrations, service principals, delegated permissions, or administrator consent. An attacker may create an application that continues to access data after the interactive account is secured. Remove unauthorized objects and permissions according to your change-control process, and review the application’s sign-in and audit activity.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Mailbox rules and forwarding
Inspect inbox rules, forwarding addresses, delegates, and transport-related changes. Malicious rules can hide security notifications or copy sensitive mail externally. Remove unauthorized rules and forwarding, then check whether confidential messages were accessed or redirected.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePrivilege and group changes
Review role assignments, group membership, ownership changes, and elevation events. Pay particular attention to Global Administrator and other privileged roles, newly created accounts, and changes made by unfamiliar applications or service principals.
Sensitive-resource access
Correlate sign-ins with access to files, sites, mailboxes, administrative portals, and other sensitive resources. Preserve relevant logs and follow your organization’s incident-response and notification requirements if data exposure is possible.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect privileged administrators with phishing-resistant MFA
Privileged accounts have a larger blast radius and should use phishing-resistant authentication rather than relying only on ordinary MFA prompts. Microsoft documents FIDO2 security keys, passkeys, Windows Hello for Business, and certificate-based methods for this purpose.
A FIDO2 security key is a physical authenticator that can use USB, NFC, or Bluetooth, depending on the key and client. Its private key remains on the device; Microsoft describes this as: “The private key never leaves the security key, which provides strong protection against remote phishing attacks.”
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Before selecting a key or passkey profile, verify the connector type, operating-system and browser support, the Microsoft Entra passkey configuration, attestation requirements, and tenant licensing. Register at least two trusted methods for each critical administrator, store the backup according to your security policy, and test sign-in and recovery without disabling the emergency-access procedure.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Choose the recovery path by situation
| Situation | Immediate response | Recovery emphasis |
|---|---|---|
| Expected VPN, travel, or new office | Validate the network, device, user, and timing; do not reset automatically. | Document the explanation and confirm or dismiss the risk only after review. |
| Unfamiliar sign-in with no proof of takeover | Investigate related events and consider a risk-based MFA challenge. | Watch for additional failures, new devices, and changes to authentication methods. |
| Confirmed unauthorized sign-in | Mark compromised, reset the password, revoke sessions, and block when needed. | Remove attacker-added methods, applications, rules, and privileges. |
| Privileged administrator compromise | Block promptly, revoke tokens, reset through an independent path, and involve the identity incident lead. | Use phishing-resistant MFA and review every privileged action during the incident window. |
| Account cannot complete MFA or SSPR | Keep the account blocked while an administrator verifies the person independently. | Remove untrusted methods, re-register approved methods, and test recovery before restoring access. |
Common mistakes and how to correct them
Resetting only the password
A password reset does not remove attacker-added authentication methods, app permissions, mailbox rules, or existing refresh tokens. Pair the reset with token and session revocation, method review, and audit-log analysis.
Dismissing a location alert without checking the device
Location is approximate and VPNs can make a legitimate user appear elsewhere, but the same explanation does not prove that the device or application is trusted. Validate all available fields before closing the event.
Relying on MFA approval as proof of identity
MFA fatigue, stolen sessions, compromised devices, and an attacker-controlled method can all defeat that assumption. Ask whether the user initiated the exact sign-in and examine the authentication method and device context.
Enforcing Conditional Access before enrollment
If users have no registered MFA or SSPR method, a remediation policy can create a lockout rather than a recovery path. Pilot the policy, register required methods, and keep a tested emergency-access account outside the normal assignment.
Locking every administrator out
Exclude emergency-access accounts from policies that could block all administrators, protect those accounts with strong credentials and monitoring, and test the sign-in procedure regularly. Never use a break-glass account as a routine administrator identity.
Failing to preserve evidence
Record event IDs, times, IP addresses, applications, actions taken, and relevant audit entries before logs age out. Evidence supports accurate risk-state decisions and helps determine whether notification or broader response is required.
Prevention checklist for Microsoft 365 tenants
- Enable and monitor Identity Protection risk reports for risky sign-ins and risky users.
- Configure risk-based Conditional Access for sign-in risk and high user risk, with report-only testing before enforcement.
- Provide working MFA registration and SSPR before requiring users to remediate risk themselves.
- Require phishing-resistant MFA for privileged administrators and users who are repeatedly targeted.
- Maintain at least one tested emergency-access path and monitor its use.
- Review audit logs for app registrations, consent, mailbox rules, authentication-method edits, group changes, role assignments, and sensitive-resource access.
- Train users to report unexpected MFA prompts, password-reset messages, and unfamiliar sign-ins through a channel independent of the affected account.
- Document who can block users, reset credentials, revoke sessions, remove applications, and approve restoration after an incident.
The Bottom Line
Investigate every risky sign-in in Entra ID Protection, but reserve a confirmed-compromise decision for evidence. When compromise is established, reset the password, revoke sessions and refresh tokens, block access when necessary, remove attacker-added methods and persistence, and restore the user only after the account and its surrounding activity are clean.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
