You have a Microsoft 365 E5 subscription that contains three users named User1, User2, and...

User1: 3

User2 and User3: 4

Microsoft Entra ID Protection generates a Users at risk detected email when a user’s calculated risk level reaches the configured threshold. In this case, the threshold is Low or above, so Low, Medium, and High risk events all qualify. Microsoft states that the email is generated when the user’s risk level reaches the configured risk level, and additional emails can be generated when later detections recalculate the user risk level at the configured level or higher. Microsoft also states that only one email is sent within a five-second period, and if multiple users move to the configured risk level during that same five-second period, the data is aggregated into one email.

For User1, alerts occur at 8:00:10, 8:02:00, and 8:05:00. The 8:02:04 High event is within five seconds of the 8:02:00 Medium event, so it does not create a separate alert. Therefore, User1 receives 3 alerts.

For User2 and User3, the 8:00:00 events are aggregated into one alert, the 8:03:01 events are aggregated into one alert, then User3 at 8:10:00 generates another, and User2 at 9:00:00 generates another. Total: 4 alerts. References/topics: Microsoft Entra ID Protection, Users at risk detected alerts, user risk threshold, alert aggregation window.