Microsoft Entra ID: Are sign-in records updated after risk-state changes?

Question

Microsoft Entra ID: Are sign-in records updated after risk-state changes?

Mohammed Huzaifa Shaikh 0

Product: Microsoft Entra ID

Question:

If a sign-in record returned by Microsoft Graph (/auditLogs/signIns) is later reclassified (for example, Confirm Compromised, Confirm Safe, Dismissed, Remediated, or other risk-related updates), does Microsoft Entra ID update the existing sign-in record and return the same sign-in id with updated risk fields?

Or are risk-state changes exposed only through Identity Protection entities such as riskDetections?

Specifically, can an existing sign-in record be modified after its original createdDateTime, and if yes, how can those updates be detected through Microsoft Graph?

Derek Morgan II 85 Reputation points

2026-08-31T16:04:55.12+00:00
Hi @Mohammed Huzaifa Shaikh

Short answer: yes, it gets updated in place.

The signIn resource has three methods built for exactly this: confirmCompromised, confirmSafe, and dismiss. All three act on the existing sign-in object, not a new record. And riskState / riskDetail / riskLevelAggregated are native properties on signIn itself, right next to ipAddress and appDisplayName. Nothing about risk lives only in the audit logs.

Microsoft's own remediation doc confirms the mutation, state by state:

Confirmed compromised: riskState "atRisk" → "confirmedCompromised", riskDetail → "Admin confirmed user compromised"

Dismissed: "atRisk" → "dismissed"

Remediated (MFA, password change, admin temp password): "atRisk" → "remediated"

So when you pull /auditLogs/signIns and see confirmedCompromised, that's the same sign-in event, just reclassified after your investigation, not a duplicate.

One thing worth separating out: the admin action itself (who dismissed/confirmed, when) does get logged separately in the Entra directory audit logs, distinct from the sign-in record's risk fields changing. So you've got two things happening, not one instead of the other.

Docs:

signIn resource type - Graph v1.0

Remediate risks and unblock users
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Your answer

Derek Morgan II 85 Reputation points

2026-08-31T16:04:55.12+00:00

Hi @Mohammed Huzaifa Shaikh

Short answer: yes, it gets updated in place.

The signIn resource has three methods built for exactly this: confirmCompromised, confirmSafe, and dismiss. All three act on the existing sign-in object, not a new record. And riskState / riskDetail / riskLevelAggregated are native properties on signIn itself, right next to ipAddress and appDisplayName. Nothing about risk lives only in the audit logs.

Microsoft's own remediation doc confirms the mutation, state by state:

Confirmed compromised: riskState "atRisk" → "confirmedCompromised", riskDetail → "Admin confirmed user compromised"

Dismissed: "atRisk" → "dismissed"

Remediated (MFA, password change, admin temp password): "atRisk" → "remediated"

So when you pull /auditLogs/signIns and see confirmedCompromised, that's the same sign-in event, just reclassified after your investigation, not a duplicate.

One thing worth separating out: the admin action itself (who dismissed/confirmed, when) does get logged separately in the Entra directory audit logs, distinct from the sign-in record's risk fields changing. So you've got two things happening, not one instead of the other.

Docs:

signIn resource type - Graph v1.0

Remediate risks and unblock users
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.