After a phishing incident, we reset passwords and revoked sessions. There have been no successful malicious sign-ins since, but attempts using an apparently revoked token keep failing and the affected users are repeatedly marked high risk.
Our policy then blocks their Microsoft 365 sign-ins. Why would a failed attempt trigger user risk, and is there a way to stop the recurring lockouts without excluding the users?
A failed sign-in and a high-risk user are measuring different things. The token rejection means that particular grant was not accepted. The user risk assessment can still reflect evidence that the account is under threat, even when an individual attempt fails.
That does not prove the old token replay is the exact reason for each new high-risk detection. Check the risk detections and their timestamps alongside the sign-in logs to see what Entra is reporting. If it is unclear why the risk keeps returning, that information should help when asking Microsoft support to investigate.
You can dismiss user risk, but that may only clear the current state. If another detection comes in, the user can be marked high risk again and hit the same policy. Dismissing it is not the same thing as stopping the attempts or fixing whatever is generating the detection.
Blocking the source IP is worth investigating, but I would not assume it will stop the risk detections. Look at whether a Conditional Access policy fits your setup, then check its actual effect on sign-ins and risk. The reported attempts are already failing, so a block may not address why the user risk is being raised.
I would be cautious about excluding the affected users from the risk policy just to restore access. That changes the protection for accounts that may still be targeted.
Answers are reviewed before publication.
m.508~sockcase:
That matches the problem. Dismissing the risk lets people back in, but it does not prevent another lockout.