Identity Protection

Entra ID Protection in Practice: Risk Policies, Leaked Credentials, and Surviving a Mass Account Lockout

The April 2025 MACE Credential Revocation incident locked out users across hundreds of organizations — triggered by a Microsoft false-positive bug, not an actual breach. This guide covers how Entra ID Protection risk policies work, how to deploy them without causing a self-inflicted outage, and how to bulk-remediate hundreds of flagged accounts with PowerShell.