Advanced endpoint threat detection

 Identity Protection uses adaptive machine learning algorithms and heuristics to detect anomalies and risk detections that might indicate that an identity has been compromised. Using this data, Identity protection generates reports and alerts so that you can investigate these risk detections and take appropriate remediation or mitigation action.

Reference:

https://docs.microsoft.com/en-us/azure/security/fundamentals/threat-detection