New Authentication Method Added after Suspicious Session Activity

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•1•0•5

Detects the registration of a new authentication method (phone, authenticator app, passkey, or security key) in Azure Active Directory after a session exhibits unusual location or token behavior, indicated by a high or medium risk level, anonymous proxy usage, or unfamiliar features.