michaelsendpoint.com

Appearance

Identity Risk Management Agent ​

👋 Introduction ​

Now that Security Copilot slowly gets activated in all M365 E5 tenants, people get access to all the great Security Copilot Agents. The Identity Risk Management Agent is one of these agents, helping IT and security teams deal with alert overload by figuring out which risks matter most. It will help you prioritize and remediate risky users in your environment and suggest actions to take.

Prerequisites

  • Microsoft Entra ID P2 license.
  • Unused Security compute units (SCU) (A run consumes less than one SCU on average).
  • Needed Microsoft Entra roles:
    • Security Administrator is required to activate the agent the first time and view the agent and take action on the suggestions.
    • Security Reader and Global Reader can view the agent and any suggestions, but can't take any actions.

Known limitations

  • Each run supports up to 100 risky users at the moment (Scope can be adjusted in settings).
  • Once an agent run starts, it can't be stopped or paused (Takes 10-15 minutes to finish on 100 users).
  • The agent currently analyzes user identity's only (Analysing Workload Identities isn't supported at the moment).
  • Agent suggestions require manual admin approval (Automatic remediation isn't supported at the moment).
  • The agent uses Entra data, such as sign-in logs, risk detections, risky users and audit logs.

How it works

  1. Check for risky users: The agent checks for any new risky users in your environment and starts an investigation on them.
  2. Investigate the risky user: The agent checks the user's risky sign-ins and risk detections to analyze what's risky about this user.
  3. Generate findings and a risk summary: The agent generates findings based on the investigation, which includes a thorough risk summary explaining the suggestion and defining the key risk factors.
  4. Generate a recommended remediation action: The agent suggests a remediation action, using the information gathered during the investigation.
  5. Store custom instructions in agent memory: Customers can give the agent custom instructions through agent chat, which the agent stores in its memory and applies for future runs. Currently, agent memory can store preferred remediation recommendations.

▶️ Getting started ​

Activation ​

  1. Open the Entra admin center -> ID Protection -> Risky users.
  2. If you never started the agent before, you will see a banner alerting you to your access.
  1. When you select Get started, the agent will show you some information where you need to click Continue and Get Started again.
  1. After that the Agent will activate itself and you will be dumped into the Security Copilot Agent view in Entra.
  1. From here you can start the Agent and see an additional information windows about how the agent triggers, its permissions, identity, which products it is using and which Entra roles can use the agent.
  1. In the Agent itself, you will have the Overview, Activities and Settings tabs. You can either wait for the agent to run automatically or start it directly by clicking Start one-time run.

IMPORTANT

Scanning for users with the "at risk" state will not consume SCUs. Checking newly found identities will.

  1. When the Agent has already run, you will see the latest runs and the schedule in the Overview tab. You can also jump directly into the latest findings with the button View agent findings.
  1. In the Activities tab, you can see past runs and their status. You can also view actions taken from the different runs.

Settings ​

The Identity Risk Management Agent proactively analyzes user behavior to detect and mitigate identity risks. You can configure execution frequency, email notifications, and other settings to fit your organization's needs.

You can access the settings directly here in the Entra agent library in the Settings tab or open it through the Risky users blade under ID Protection. There you select the Agent view, and click on the ellipses in the upper-right corner and then select Settings.

Controls

Here you can find options to configure the agents triggers and scope.

Trigger

Configure how often the agent runs:

  • Daily trigger: Runs automatically every 24 hours.
  • Continuous monitoring: Checks every 5 minutes for new risky users.
  • Manual run: Runs on-demand only.

Scope

Customize what the agent scans:

  • Choose specific users and groups to monitor.
  • Set maximum recent risky users to scan (1-100, default 100).
  • Select risk levels to include (all selected by default).
  • Define time frame: Last 7, 14, or 30 days, or custom up to 90 days.

Permissions

Here you can find the Managed agent identity used by the agent and the permissions required to access risk detections, risk history, sign-in and audit logs and user information. These agent uses the Security Administrator role.

Communications

Here you can enable email notifications and recipients. Notifications are disabled by default.

Memory

Here you can review the feedback provided by you and your team. The agent uses feedback to improve its suggestions and remembers feedback such as marking a false positive as confirmed safe for future runs.

🔎 Agent findings ​

Risky users report ​

You can review the agent's findings and suggestions in the Risky users report in Microsoft Entra ID Protection.

For that open the Entra admin center -> ID Protection -> Risky users and select the Agent view option at the top of the report.

Standard view

In the standard view of the risky users report, you will find a nice pie chart and graph showing the distribution of risky users by risk level and the number of risky users over time. At the bottom you can also find a list with the latest risky users, their risk state and risk level.

Agent view

In the agent view the top section gives you a quick overview of recent agent activity, with options to Chat with agent or Manage agent. After that come the current active suggestions and below that, you’ll find the list of individual risky users. Select a user to see insights and recommendations for them.

  • Agent summary: Shows recent agent activity and provides quick access to Chat with agent and Manage agent, where you can run the agent once or open its settings.
  • Agent suggestions: Displays recommended actions and lets you apply bulk remediations, such as Dismiss risk or Reset password.
  • Risky users list: Lists all risky users along with agent findings, risk factors and recommended actions that can be applied directly from the table.

Risky user details ​

When opening a risky user from the list, you will see the Risky user details page, which provides a detailed view of the agent's findings and recommendations for that specific user.

  • Basic user information: Username, current risk level, and UPN
  • Agent findings: The agent provides a verdict of Compromised or Not compromised based on its investigation.
  • Risk summary: A detailed explanation of the agent's findings, based on analysis of the user's sign-ins and behaviors.
  • Risk factors: Key risk indicators summarized for easy review.
  • Suggested remediation action: A button that allows you to directly start the remediation.

At the bottom of the page you find a graph and map of recent sign-in activity.

  • User's risk level graph: A historical trend of the user's risk level over the past 7 days.
  • User's past sign-in counts: The number of sign-ins for this user in the past 7 days.
  • Risky sign-in map: A map showing the locations of risky sign-ins for this user.

If you click on the Review with agent button, you can ask the agent questions about the risky user and its findings.

🔒 Remediation ​

When you click the button to start a remediation action, the agent will provide you with the steps to remediate the risky users.

In this example, remediating a passwordless user with a Conditional Access policy (Clicked the Create policy button seen in the previous section).

  1. After starting a bulk remediation, you will first get a window with a list of users the remediation will be applied to.
  1. Next, the agent puts you straight into the Conditional access policy creation wizard, where the policy settings are already done and you can review them. Then just create the policy and the remediation is done.

When you try to sign in with the remediated user, you will see that the user is now blocked from signing in until the remediation is completed.

💡 Conclusion ​

The Identity Risk Management Agent is a powerful tool for organizations looking to strengthen their security posture and respond to identity threats more efficiently. Its ability to provide actionable insights and streamline remediation for risky users, makes it a valuable addition to your security toolkit. It can run continuously, helping you quickly detect and respond to new developments and it only consumes SCUs when new risky sign-ins are checked.

References