Suspicious Login Issues

How to Fix Azure Sign-In Blocked by Detection Rule TI_RT_0015

Bushra Parveen Oct 12, 2026 869 views

Question details

The user is experiencing an Azure sign-in block triggered by the TI_RT_0015 real-time detection rule after an account was reported as compromised and the password was reset.

How to Fix Azure Sign-In Blocked by Detection Rule TI_RT_0015

Product: Microsoft Azure
Device & OS: not provided
Scenario: Attempting to sign in to an Azure account after a security remediation event.
Observed behavior: Sign-ins remain blocked by the real-time detection rule TI_RT_0015 despite the password having been reset.

Before you start

Ensure you have Global Administrator or Security Administrator privileges in your Microsoft Entra ID (formerly Azure AD) tenant to review risk detections and authentication logs.

Solution 1Recommended

Review Entra ID Risk Detections and Remediate

Investigate the affected user's sign-in logs and risk detections in Microsoft Entra ID to clear the block.

Rule TI_RT_0015 is related to Microsoft Entra ID Identity Protection and risk-based sign-in detection. When an account is flagged as compromised, simply resetting the password may not clear the high-risk state automatically if not done via a secure self-service password reset (SSPR).

Access Entra Admin Center

Navigate to Identity Protection

In the left-hand menu, go to Protection, and then select Identity Protection. Click on Risk detections or Risky users.

Review Affected Users

Search for the affected user and review the sign-in risk details, risk detections, and authentication logs to understand why rule TI_RT_0015 was triggered.

Clear the Risk State

If you verify that the account is now secure following the password reset, manually select 'Dismiss user risk' to remove the block and allow the user to sign in.

Review Entra ID Risk Detections and Remediate

Identity Protection Licensing: Detailed risk detection reporting requires a Microsoft Entra ID P2 license.

Solution 2

Escalate to Microsoft Support or Q&A

If the block persists after clearing user risk, escalate the issue for account-specific analysis.

Free Microsoft Office alternative

Try WPS Office for Your Daily Productivity Needs

While resolving complex cloud identity issues can be time-consuming, your everyday document tasks shouldn't be. WPS Office is a lightweight, free alternative to Microsoft Office that offers comprehensive tools for documents, spreadsheets, and presentations without restrictive sign-in blocks.

1. Download the Installer: Visit the official WPS website and click 'Download WPS Office Free' to get the installation package.
2. Install WPS Office: Run the setup file and follow the on-screen instructions. The installation is fast and lightweight.
3. Open Microsoft Formats Seamlessly: Launch WPS Office and directly open your .docx, .xlsx, or .pptx files with full formatting compatibility.

Highly compatible with Microsoft Word, Excel, and PowerPoint file formats.Lightweight installation that doesn't consume excessive system resources.Familiar user interface requiring zero learning curve.Free to use with built-in PDF editing capabilities.

microsoft office alternative - wps office

Frequently Asked Questions

What does real-time detection rule TI_RT_0015 mean in Azure?

This rule is part of Microsoft Entra ID Identity Protection. It indicates a risk-based sign-in detection triggered by suspicious login activity or compromised credentials, requiring further administrative review.

Why is the account still blocked after a password reset?

Identity Protection may maintain the block if the risk state of the user hasn't been explicitly cleared or dismissed in the Entra ID admin center, or if the password reset was performed outside of a secure self-service password reset (SSPR) policy.

How do I unblock an account flagged as compromised?

An administrator must review the user's risk profile in Microsoft Entra ID and select 'Dismiss user risk' or 'Confirm user compromised', followed by a secure password reset, to fully restore access.

Microsoft Office Security Issues