> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/purview-alerts-ual.md). # Purview Alerts (UAL) These alerts layer Augmentt's own detection logic on top of Purview's Unified Audit Log — they don't require Entra ID P1, P2, or Defender licensing, which makes them the most broadly available sign-in risk coverage in the catalog. Licensed at **Basic (non-P1)**. {% hint style="warning" %} To capture these, Unified Audit Logs must be enabled on the tenant. You can enable this with a single click from Augmentt's Security Posture checks. {% endhint %} {% hint style="info" %} **Update (Jul 2024):** sign-in-outside-country alerts are now capped at one per user per day, to cut down on repeat-travel noise. If the account is genuinely under attack, the "3 attempts in an hour" or "5 attempts in a day" alerts will still fire separately. {% endhint %} Reference: [Search the audit log in Microsoft Purview](https://learn.microsoft.com/en-us/purview/audit-search). | Alert | Category | Severity | Enabled by default? | What it alerts on | | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------ | -------- | ------------------- | ---------------------------------------------------------------------------------------------------------------- | | **Successful sign-in from typically malicious country** `office365_ualrule_successful_signin_outside_country_from_bad_country_list` | Sign-in Risk | High | Yes | A sign-in succeeded from a country on Microsoft's list of countries commonly associated with malicious activity. | | **Successful sign-in without MFA from outside operating country** *type key not confirmed* | Sign-in Risk | High | Yes | A user signed in successfully without MFA from a country outside the tenant's normal operating country. | | **At least 3 sign-in attempts from outside operating country within an hour** `office365_ualrule_three_failed_signin_attempts_from_outside_operating_country` | Sign-in Risk | Medium | Yes | The same user attempted to sign in 3 or more times from outside the operating country within one hour. | | **At least 5 sign-in attempts from outside operating country within 24 hours** `office365_ualrule_five_failed_signin_attempts_from_outside_operating_country` | Sign-in Risk | Medium | Yes | The same user attempted to sign in 5 or more times from outside the operating country within 24 hours. | | **Sign-in attempt from typically malicious country** `office365_ualrule_failed_signin_outside_country_from_bad_country_list` | Sign-in Risk | High | No — optional | Any sign-in attempt, successful or not, came from a country on Microsoft's malicious-country list. | | **Risky Sign-In Inside Country** `office365_ipcrisk_signin_inside_country` | Sign-in Risk | Low | No — optional | A sign-in from inside the tenant's operating country was flagged as risky. | | **Risky Sign-In Outside Country** `office365_ipcrisk_signin_outside_country` | Sign-in Risk | High | Yes | A sign-in from outside the tenant's operating country was flagged as risky. | | **Sign-in attempt without MFA from outside operating country** *type key not confirmed* | Sign-in Risk | Medium | No — optional | Any sign-in attempt without MFA, successful or not, came from outside the operating country. | | **Successful sign-in outside operating country** `office365_ualrule_successful_signin_from_outside_operating_country` | Sign-in Risk | High | Yes | A sign-in succeeded from outside the tenant's normal operating country, regardless of MFA. | | **Successful sign-in from unidentifiable location/IP** `office365_ualrule_successful_signin_from_unidentifiable_location_or_ip` | Sign-in Risk | Medium | Yes | A sign-in succeeded but couldn't be geolocated to a known country or IP range. | {% hint style="info" %} Two rows above don't map to a distinct `alert_type` key in the current codebase catalog — they may be handled as a configuration option within a neighboring rule rather than a standalone alert type. Worth a follow-up with engineering before treating this as a definitive claim. {% endhint %} {% hint style="warning" %} **Note on `office365_ipcrisk_*`:** a follow-up codebase check found no backend rule processor or worker that currently evaluates these two keys — they only appear in database masterlist seed data and title mappings. They may be legacy from before this catalog moved to the dedicated M365 Risk Detections page (which uses the same two keys, sourced directly from Microsoft's own risk model rather than Augmentt's UAL-based logic). Flagging this for confirmation with engineering before treating either row as reliably firing. {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://helpdesk.augmentt.com/modules/secure/alerts/monitored-alerts/purview-alerts-ual.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.