Risky Users and Risky sign-ins monitoring

Risky Users and Risky sign-ins monitoring is a recurring managed service for organizations with a Microsoft 365 tenant that need recurring monitoring of risky users and risky sign-ins. IT Partner monitors user activity and security-tool signals, prioritizes and investigates important alerts, passes real security incidents to the customer, and communicates risk and performance data so the customer stays aware of risks across the organization.

IT Partner monitors risky users, risky sign-ins, user activity, and signals from Microsoft security tools in the customer’s Microsoft 365 environment. The monitoring includes information about users currently at risk, users whose risk was remediated or dismissed, detection details, risky sign-in history, and overall risk history.

The service includes recurring monitoring of risky users and risky sign-ins, prioritization and investigation of important alerts, response to suspicious attempts, and communication of risk and performance data to the customer. It also includes assessment of attacks and mitigation steps, additional forensic data gathering, finalized auditing and documentation, and passing real security incidents to the customer.

Risky Users and Risky sign-ins monitoring is an ongoing managed service, not a one-time assessment. It is provided on a recurring basis with a regular monthly fee so that new risky users, risky sign-ins, and risk history can be monitored over time.

The listed price for Risky Users and Risky sign-ins monitoring is $10.00 per seat. The service is listed as SKU ITPWW060SECOT and is provided as a recurring service with a regular monthly fee.

The stated prerequisite is that the customer must have a Microsoft 365 tenant. The customer also needs to connect to the IT Partner monitoring system so IT Partner engineers can perform recurring monitoring.

The customer’s stated responsibility is to connect to the IT Partner monitoring system. After that connection is in place, IT Partner engineers manage the recurring monitoring of risky users and risky sign-ins.

IT Partner monitors user activity and security-tool signals to identify events that merit attention, using machine learning and behavioral analytics to help reduce false positives and alert fatigue. IT Partner also prioritizes and investigates important alerts, passes real security incidents to the customer, assesses attacks and mitigation steps, gathers additional forensic data, and finalizes auditing and documentation.

The customer is responsible for connecting to the IT Partner monitoring system. The source scope does not list additional customer responsibilities, so any required approvals, access requirements, or internal response procedures should be confirmed with IT Partner before onboarding.

When IT Partner identifies a real security incident, the incident is passed to the customer. IT Partner also assesses the attack and mitigation steps, gathers additional forensic data, and finalizes auditing and documentation as part of the stated service deliverables.

The service includes monitoring alerts and selecting the most important ones for further investigation. IT Partner prioritizes alerts because the service is designed to focus attention on events that merit action and reduce false positives and alert fatigue.

IT Partner uses security-tool signals, machine learning, and behavioral analytics to help identify events that merit attention. This helps reduce false positives and alert fatigue while improving visibility into complex events such as lateral movement, insider threats, and data exfiltration.

The service helps identify risky users, risky sign-ins, detection details, risk history, and cases where risk was remediated or dismissed. The stated scope also references hard-to-detect complex events such as lateral movement, insider threats, and data exfiltration.

Yes, the service includes communication of risk and performance data to the customer, as well as finalized auditing and documentation. The information can include which users are at risk, which risks were remediated or dismissed, detection details, history of risky sign-ins, and risk history.

The provided scope does not specify any planned downtime or user disruption for this monitoring service. Because the service is based on monitoring a Microsoft 365 tenant and connecting to the IT Partner monitoring system, any operational impact should be confirmed with IT Partner during onboarding.

The source does not specify a fixed implementation timeline. The stated implementation plan has two milestones: the customer connects to the IT Partner monitoring system, and then IT Partner engineers perform recurring monitoring.

After the customer connects to the IT Partner monitoring system, IT Partner begins recurring monitoring of risky users and risky sign-ins. The service continues on an ongoing recurring basis, with IT Partner monitoring risks, investigating important alerts, passing real incidents to the customer, and communicating risk and performance data.

The service includes response to suspicious attempts, assessment of attacks and mitigation steps, forensic data gathering, auditing, documentation, and passing real security incidents to the customer. The source does not specify a full hands-on remediation scope or guaranteed containment actions, so remediation responsibilities and authorization should be confirmed with IT Partner.

24/7 support, continuous monitoring, and ongoing maintenance are not included by default. They are available as optional extra-cost add-ons delivered through IT Partner's NOC, third-party support partnerships, and a Microsoft Premier Support agreement when separately purchased and stated in the customer agreement. Prospective buyers should also confirm with IT Partner whether activities such as broader incident response, configuration changes, remediation execution, or non-Microsoft 365 monitoring are included or handled separately.

The service information lists Roman Sotnik as the manager for Risky Users and Risky sign-ins monitoring. The service itself is delivered by IT Partner engineers who manage recurring monitoring and investigation activities.