Entra: the risk level is not the error code

The error code is the attempt

status.errorCode is the result code for this sign-in. Zero means the attempt succeeded as far as that code is concerned. A non-zero code means the attempt failed or was stopped, and the number is the code, not a sentence you invent. Look up a code you do not know. Do not rename it as a risk word.

The code does not list other sign-ins. It is this record.

The risk label is a second field

riskLevelDuringSignIn, when the record has it, is the label the risk service attached to this sign-in: none, low, medium, high, or whatever string is printed. It can be present on a successful attempt. It is not the error code, and it is not a history of every earlier sign-in.

If the field is missing, write “risk level not on this record.” Do not turn error code 0 into “none.”

What to file

File the sign-in id, the error code, and the risk label as two lines. If you mention a later decision, say it came from a person. Neither field is itself an instruction to disable the account.

Worked case: success read as no risk

A lab sign-in for sam@hackblue-lab.org shows error code 0 and riskLevelDuringSignIn medium. A draft closes the review because zero means the risk service cleared the attempt.

The note quotes 0 as the attempt result and medium as the risk label on this record. Success did not erase the label. The review does not close on the code alone, and the label is not expanded into a list of other sign-ins.

account: sam@hackblue-lab.org
status.errorCode: 0
riskLevelDuringSignIn: medium
write: success, and medium on this record
not: zero means the risk label is clear
not: a history of other sign-ins