Identity_Threat_Detection / Review sign-ins, MFA events, device history, geo/IP changes, privilege changes, session tokens, then revoke sessions or disable the account only if evidence supports it. · size 20 · threshold 4 · max attempts 3