Identity Protection sign-in risk policy is enabled

Check ID: entra_identity_protection_sign_in_risk_enabled
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e5
Resource type: NotDefined

What this check verifies

Microsoft Entra Conditional Access has a sign-in risk-based Identity Protection policy that targets All users and All cloud apps, evaluates Medium and High sign-in risk, requires MFA, sets sign-in frequency: every time, and is actively enforced not report-only.

Risk

Without this policy, risky authentications using stolen or replayed credentials may proceed without step-up verification, enabling account takeover. Attackers can establish persistent sessions, exfiltrate data, change configurations, and move laterally-eroding confidentiality and integrity and potentially impacting availability through privilege abuse.

Recommendation

Adopt a risk-based Conditional Access policy for sign-in risk that applies broadly and enforces MFA with every-time reauthentication for Medium and High risk. Align with Zero Trust and least privilege: ensure MFA enrollment, exclude emergency accounts, validate in report-only, then enforce and regularly review risky sign-in reports.

Remediation

CLI
Terraform
Dashboard steps

New-MgIdentityConditionalAccessPolicy -BodyParameter @{displayName='<example_resource_name>';state='enabled';conditions=@{users=@{includeUsers=@('All')};applications=@{includeApplications=@('All')};signInRiskLevels=@('medium','high')};grantControls=@{operator='OR';builtInControls=@('mfa')};sessionControls=@{signInFrequency=@{isEnabled=$true;frequencyInterval='everyTime'}}}

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled" # Critical: enforce policy

  conditions {
    users {
      include_users = ["All"] # Critical: apply to all users
    }
    applications {
      include_applications = ["All"] # Critical: apply to all apps
    }
    sign_in_risk_levels = ["medium", "high"] # Critical: protect Medium and High sign-in risks
    client_app_types    = ["all"]
  }

  grant_controls {
    operator          = "OR"
    built_in_controls = ["mfa"] # Critical: require MFA
  }

  session_controls {
    sign_in_frequency_interval = "everyTime" # Critical: require reauth every time
  }
}

References

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_identity_protection_sign_in_risk_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Microsoft 365 checks

Emergency access accounts are excluded from lockout Identity Protection user risk policy is enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires