Conditional Access blocks elevated insider risk users

​

What this check verifies

This check verifies that at least one enabled Conditional Access policy blocks access to all cloud applications for users flagged with an elevated insider risk level by Microsoft Purview Insider Risk Management and Adaptive Protection.

​

Risk

Without blocking elevated insider risk users, compromised or malicious insiders retain full access to cloud applications. This enables data exfiltration, unauthorized modifications, and lateral movement, directly impacting confidentiality and integrity.

​

Recommendation

Configure Adaptive Protection in Microsoft Purview to classify insider risk tiers, then create a Conditional Access policy that blocks access to all cloud apps for users with elevated risk. Only exclude dedicated break-glass accounts.

​

Remediation

Dashboard steps

1. In the Microsoft Entra admin center, go to Protection > Conditional Access > Policies.
2. Click New policy.
3. Under Users, select Include > All users.
4. Under Target resources, select Include > All cloud apps.
5. Under Conditions > Insider risk, select Configure > Yes, then check Elevated.
6. Under Grant, select Block access.
7. Set Enable policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-insider-risk

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_block_elevated_insider_risk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks