Conditional Access blocks Office 365 on insider risk

​

What this check verifies

A Conditional Access policy configured to block Office 365 access for users flagged with elevated insider risk by Microsoft Purview Adaptive Protection. This control uses behavioral signals to restrict access when a user’s risk level indicates potential insider threat activity.

​

Risk

Without a policy blocking Office 365 for elevated insider risk users, compromised or malicious insiders can continue accessing email, SharePoint, OneDrive, and Teams. This may lead to data exfiltration, unauthorized sharing of sensitive information, or tampering with critical business communications.

​

Recommendation

Configure a Conditional Access policy to block Office 365 access for users with elevated insider risk levels. This leverages Microsoft Purview Adaptive Protection signals to dynamically restrict access based on user behavior analysis. Ensure Insider Risk Management and Adaptive Protection are configured in Microsoft Purview as prerequisites.

​

Remediation

Dashboard steps

1. Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
2. Expand Protection > Conditional Access and select Policies.
3. Click New policy.
4. Under Users, select All users.
5. Under Target resources > Cloud apps, select Office 365.
6. Under Conditions > Insider risk, select Elevated.
7. Under Grant, select Block access.
8. Set the policy to On and click Create.

​

References

• https://learn.microsoft.com/en-us/purview/insider-risk-management-adaptive-protection
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/how-to-policy-insider-risk

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_conditional_access_policy_block_o365_elevated_insider_risk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks