Entra ID - User Risk - On Premises Password Change
Azure AD User Risk On Premise Password Change
Query
AuditLogs
| where OperationName == "Update StsRefreshTokenValidFrom Timestamp"About this query
Explanation
This query is used to identify users who have remediated their User Risk through an on-premises password change. It looks for audit logs of the "Change user password" operation and the "Update StsRefreshTokenValidFrom Timestamp" operation. When the "Allow on-premises password change to reset user risk" setting is enabled, it also looks for AADUserRiskEvents with the RiskDetail "userChangedPasswordOnPremises".