Risk Detection signals
Last updated
Last updated
This document describes the risk detection signals used to evaluate login attempts for Business Accounts.
Risk detection signals are used to determine whether a login attempt should:
Be allowed normally
Require step-up authentication
Be blocked entirely
These signals operate as part of Enforced Security Policies.
If you want to understand why a user is asked to perform additional authentication, start here.
Risk detection signals explain what the system looks at when deciding whether a login attempt is risky.
Risk detection signals enable the system to:
Detect suspicious or abnormal login behavior
Reduce account takeover risk
Apply stronger authentication only when necessary
Balance security with user experience
Before risk detection can be applied:
Risk signals are grouped into the following categories:
Risk Detection Signals ├── IP-Based Signals ├── Location-Based Signals ├── Device-Based Signals ├── Behavior-Based Signals └── Policy Context Signals
Evaluate whether the source IP address is suspicious or unusual.
Detect abnormal geographic login behavior.
Evaluate whether the login device is trusted or recognized.
Analyze user login behavior patterns.
Apply organizational context and policy configuration.
Each login attempt is evaluated in real time.
Risk thresholds are configurable at the organization level.
The organization must have Enforced Security Policies enabled
Users must sign in through the organization-managed identity provider
Login context data (IP, device, location) must be available
New IP address not previously associated with the user
IP outside of trusted IP ranges
IP address on denylist or known malicious range
Rapid IP changes during a single session
Medium to High risk
May trigger MFA or access denial
Login from a new country or region
Impossible travel scenarios (rapid country changes)
Location inconsistent with organization policies
Medium to High risk
May trigger step-up authentication
New or unrecognized device
Device fingerprint mismatch
Unsupported or restricted platform
Browser or OS changes
Medium risk
Often triggers MFA challenge
Unusual login time
Multiple failed login attempts
Abnormal login frequency
Automated or scripted behavior patterns
Medium to High risk
May result in MFA enforcement or temporary blocking
User role requires stronger authentication
Workspace-specific security rules
Elevated access or sensitive resource access
Compliance-driven enforcement
Medium to High risk
May enforce stronger MFA methods
Risk Level
Outcome
Risk Level
Outcome
Low
Standard authentication
Medium
Step-up authentication (MFA)
High
Strong MFA or access blocked
Users are guided clearly when additional verification is required
Risk-based challenges are contextual and non-intrusive
Legitimate users can proceed after successful verification