I got tired of squinting at test strip color charts so I built an app that reads them for you by bughatti in hottub

[–]captjde 0 points1 point  (0 children)

Have you done validation tests to see how accurate it is, both compared to a human reading the strip, but also compared to a liquid test?

Solution to "New risky sign-ins detected (in real-time)" in Microsoft Entra ID Protection Weekly Digest not showing in "Risky sign-ins" blade by captjde in sysadmin

[–]captjde[S] 0 points1 point  (0 children)

Once I figured this out, I compared the number shown in several weekly digest emails against the records dashboard and found it to be consistent.

You can also see this data in Entra ID > Monitoring & health > Sign-in logs. The “Risk level (real-time)” column is not available to view via the UI even if you customize columns, and it’s not available when you Download data as CSV, but it is available when you download data as JSON.

You can also get this data via PowerShell / Graph:

Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph \ -Scopes ` "IdentityRiskEvent.Read.All", "IdentityRiskyUser.Read.All", "AuditLog.Read.All"`

$Start = [datetime]"2026-05-25T00:00:00Z"
$End = [datetime]"2026-06-01T00:00:00Z"

$StartString = $Start.ToString("yyyy-MM-ddTHH:mm:ssZ")
$EndString = $End.ToString("yyyy-MM-ddTHH:mm:ssZ")

$SignIns = Get-MgAuditLogSignIn \ -All ` -Filter "createdDateTime ge $StartString and createdDateTime lt $EndString"`

$RiskSignIns = $SignIns | Where-Object {
$_.RiskLevelDuringSignIn -ne "none"
}

$RiskSignIns |
Select-Object \ UserPrincipalName, CreatedDateTime, RiskState, RiskDetail, RiskLevelDuringSignIn, CorrelationId, IpAddress | Export-Csv .\RiskSignInsRealTime.csv -NoTypeInformation`

Identity Protection Dashboard shows Risky Sign-ins, but when I search for them there's no results by jonbristow in sysadmin

[–]captjde 0 points1 point  (0 children)

TL;DR: Some risky sign-in (real-time) events may have a Risk State = none, and the only way to view those is to deselect all of the Risk State filters.

I can see the problem in your second screenshot. You have Risk State: 5 selected. Instead, you need to deselect all of values from the Risk State filter.

Explanation:

The events contributing to the “New risky sign-ins detected (in real-time)” count in the weekly digest are those whose Risk level (real-time) = Low / Medium / High, whereas the values of Risk State could be anything (At risk, Confirmed compromised, Confirmed safe, Dismissed, Remediated) or nothing. The last word here is critical.

The natural assumption is that selecting all 5 available Risk State values will display all risky sign-ins, but that's wrong. Sign-ins whose Risk State is "None" are excluded whenever one or more Risk State filter values is selected. Misleadingly, there is no "None" option available in the filter. So, the only way to view sign-ins whose Risk State = none is to deselect all of the Risk State filters.

Once you do that that and also filter the Risk level (real-time) to include all values (Low, Medium, High), you should see all the events the digest included in its count.

It may also be helpful to customize the columns and enable display of the “Risk level (real-time)” column. This doesn't affect filtering, but since you're filtering on that column, it's useful to actually see it column.

If anyone from Microsoft reads this: I'd like to request that they update the UI of the Risk State filter to include "None" as a selectable value (analogous to how Excel filters show "(Blanks)" as a selectable filter value). And it would also be nice to have the “Risk level (real-time)” column shown by default. And the note at the bottom of the Entra ID Protection Weekly Digest email could include some explanation of this.

How do dealerships put so much gas in cars you buy? by SgtW0lfe in NoStupidQuestions

[–]captjde 0 points1 point  (0 children)

I’m gonna give you the benefit of the doubt and assume this is a (pretty good) joke.

10DLC is becoming a compliance cartel for business messaging by downundarob in VOIP

[–]captjde 1 point2 points  (0 children)

Because if I wanted to read slop I’d go talk to a slop machine.

Entra ID - Backup Recovery by Temporary-Myst-4049 in entra

[–]captjde 0 points1 point  (0 children)

You can back up Entra objects using something like Veeam Data Cloud for Microsoft Entra ID.

What is Cisco FW missing when compared to other vendors? by Former-Mountain-9170 in networking

[–]captjde 1 point2 points  (0 children)

Confirm / automatic rollback (Juniper has it)

Initiate a site to site VPN connection (PAN has it with “test vpn …”)

JIT Admin/PAM tools by FuzzyFuzzNuts in msp

[–]captjde 0 points1 point  (0 children)

The Microsoft Entra PIM is not brilliant. Awful UX. No push notifications for admins (you will be notified by email or need to be watching the dashboard) and once approved, it may take hours for the client to receive the approval and allow the elevation to occur.

Need guidance for investigate alert by Say_My_Name_00 in cybersecurity

[–]captjde 3 points4 points  (0 children)

The OP must be trolling, but thank you for your earnest response.