Anonymous User Succeeded Download Limit

Hi @ShallowCopy
I understand that your company received an alert that a user succeeded the file download limit (total was 58/min). Upon investigating the alert in Defender, the user ID is displaying as "urn:spo:anon#46b4476bd6f17a9622678ef53b2748cccfac0a30356a4a64ef9eecf9049507dd".

You checked the admin portal and could not find such a user. Also, you checked the sign in logs for the IP address that was listed for the user and no such sign-ins were recorded.

The risk reports are found in the Microsoft Entra admin center under ID Protection. You can navigate directly to the reports or view a summary of important insights in the dashboard view and navigate to the corresponding reports from there. To view and investigate risky users, navigate to the Risky users report and use the filters to manage the results. There's an option at the top of the page to add other columns such as risk level, status, and risk detail.

With the information provided by the Risky user's report, administrators can view:

• User risk that was remediated, dismissed, or is still currently at risk and needs investigation
• Details about detections
• Risky sign-ins associated to a given user
• Risk history

Follow the document for more information: https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk#how-to-investigate-risky-users

Hope this helps. Do let us know if you have any further queries.

If this answers your query, do click `Accept Answer` and `Yes`.