Microsoft 

Microsoft Entra ID (formerly Azure Active Directory) Risk Detection is a feature of Microsoft Entra ID Protection that uses machine learning and heuristics to detect suspicious sign-in activities and identity-based threats. It evaluates risk signals including impossible travel, anonymous IP usage, password spray attacks, and leaked credentials. 

Risk detections generate alerts categorized as user risk (indicating an identity may be compromised) or sign-in risk (indicating a specific authentication may be illegitimate). These events provide security teams with early warning of credential compromise, enabling automated responses such as MFA challenges or password resets, and supporting investigation of identity-based attacks.