How to Spot Risky Sign-Ins Before They Become a Breach

What counts as a risky sign-in at a law firm?

A risky sign-in is a login to a firm account that does not fit the person's normal pattern or matches known attacker behavior: a new country, an anonymizing VPN, travel that is physically impossible, or a password that has turned up in a leaked dataset. Microsoft 365 flags these events through Microsoft Entra ID Protection, which scores each sign-in and each user for risk.

For a law firm, the account behind that sign-in usually holds privileged email, matter files in OneDrive or SharePoint, and the thread where a client is waiting on wire instructions. A stolen session gives an attacker all of it, often without tripping any other alarm. Catching the sign-in is the cheapest point to stop the incident.

Why does a risky sign-in matter under the ethics rules?

Because ethics guidance treats watching for a breach, and responding to one, as part of protecting client confidences. Business and Professions Code section 6068(e)(1) requires an attorney to maintain inviolate the confidence, and preserve the secrets, of a client. Comment 1 to Rule 1.1 extends competence to the benefits and risks of relevant technology.

The State Bar of California applied those duties to data breaches in Formal Opinion No. 2020-203. Drawing on ABA Formal Opinion 483 (October 17, 2018), which says lawyers "must employ reasonable efforts to monitor the technology and office resources connected to the internet," the California opinion concludes that after a breach a lawyer must make a reasonable inquiry into what happened and notify any client whose interests have a reasonable possibility of being negatively impacted. It also points to Rules 5.1 and 5.3, which put managing lawyers on the hook for the policies and supervision that make this possible.

A firm cannot inquire into, or report on, a compromise it never saw. Sign-in risk data is often the first and only record that an account was used by someone else.

Which sign-in signals deserve attention first?

Start with the detections that point to a working credential in the wrong hands. Microsoft documents each detection in its risk detection reference. The ones that matter most for a firm of 5 to 100 attorneys:

• Leaked credentials: a user's valid password was found in a leaked dataset. Microsoft always rates this high risk.
• Password spray: an attacker successfully validated a user's password during a spray attack across many accounts.
• Anomalous token: a token with an abnormal lifetime or used from an unfamiliar location, a sign of session theft that can bypass MFA.
• Suspicious MFA authentication approval: an MFA approval with unfamiliar properties, which can mean an attorney approved a prompt they did not start.
• Atypical travel and new country: sign-ins from distant locations or a country the user rarely signs in from.
• Suspicious inbox forwarding and inbox manipulation rules: new rules that forward mail outside the firm or hide messages. These are classic setup steps before a wire fraud attempt on a settlement or retainer payment. Both detections need Microsoft Defender for Cloud Apps licensing in addition to P2, so without it, check inbox rules by hand.
• Anonymous IP address: a sign-in from Tor or an anonymizing VPN service.

Real-time detections are evaluated during the sign-in, so with P2 they can trigger a Conditional Access response on the spot. Microsoft says their details reach the reports in 5 to 10 minutes. Offline detections take up to 48 hours to surface, so someone has to review them after the fact.

What can you see without Microsoft Entra ID P2?

Very little detail. Microsoft's ID Protection licensing table shows that risk-based Conditional Access policies require Entra ID P2. On Free and P1, the risky sign-ins report shows no risk detail or risk level, and the risky users report shows only medium and high risk users with no history.

Without P2, most of the detections above appear only as "Additional risk detected," a placeholder that tells you something fired but not what. The anonymous IP and leaked credentials detections, plus Microsoft's threat intelligence detection, are available without P2. Many firms on Microsoft 365 Business Premium have P1, so check before assuming you have the full picture.

How far back can you look after a suspected compromise?

Not far, unless you planned for it. Microsoft Entra keeps sign-in and audit logs for 7 days on the Free tier and 30 days on P1 or P2. Upgrading a license later does not bring back older logs.

That matters for the reasonable inquiry Opinion 2020-203 describes. If a client calls six weeks after a fraudulent wire request and the logs are gone, the firm may be unable to say which accounts were accessed or when. Routing sign-in logs to longer-term storage is a small cost compared to explaining a gap in the record.

What should happen in the first hour after a risky sign-in?

Contain first, then investigate. A short, rehearsed sequence keeps a flagged sign-in from turning into a client notification problem:

• Confirm with the attorney or staff member by phone, using a number already on file, whether the sign-in was theirs.
• If it was not, revoke the user's sessions and reset the password, then require MFA re-registration.
• Check the mailbox for new forwarding or inbox rules and remove any the user did not create.
• Review recent sign-in and audit activity for file downloads, sharing changes or new app consents.
• Mark the user as compromised in Entra so the risk data trains future detections, or dismiss the risk if the user confirms it was legitimate travel.
• Record what was found, who decided what, and when. That record is the starting point if the firm later has to assess whether client notification is warranted.

The decision about notifying clients is a professional responsibility question for the firm and its counsel. The technical record determines whether that decision rests on facts.

What to do this quarter

• Confirm your Entra ID license level and whether risk-based Conditional Access is available. If it is, require MFA for medium sign-in risk and block or force a secure password change for high user risk.
• Require MFA for every account, and move partners and anyone who approves payments to phishing-resistant methods such as passkeys, which NIST SP 800-63B-4 recognizes as phishing-resistant where passwords, one-time codes and push prompts are not.
• Send sign-in and audit logs to storage that keeps them at least a year.
• Name a person who reviews risky sign-ins every business day, plus a backup for when that person is out.
• Write the first-hour sequence above into the firm's incident response plan and run it once as a tabletop with the managing partner present.
• Check Microsoft's identity secure score for open recommendations such as blocking legacy authentication.

How s90 helps

s90's Identity Posture service watches risky sign-ins and user risk for your Microsoft 365 tenant, configures risk-based Conditional Access where your licensing allows, and keeps sign-in logs long enough to support an inquiry. When a sign-in looks wrong, our team contains the account and hands your firm a written record of what happened. If you want a second look at your current settings, schedule a short identity review with us.