New Defender for Identity security alerts
Defender for IdentityMicrosoft
May 2026
New Defender for Identity security alerts
These new alerts were added to the Defender for Identity security alerts:
New alerts related to Entra ID:
- Failed credential abuse attempt in Entra ID authentication
- Malicious sign in from a randomized user agent
- Possible use of a stolen session cookie
- Stolen session cookie replay detected
- Suspected Conditional Access bypass via non-compliant device
- Suspicious addition of default third‑party MFA method to user account
