Check ID: entra_identity_protection_user_risk_enabled
Provider: Microsoft 365
Service: entra
Severity: HIGH
Categories: identity-access, e5
Resource type: NotDefined

​
What this check verifies

Microsoft Entra Conditional Access has a user risk-based policy that targets All users and All applications, evaluates High user risk, and actively enforces controls requiring both multifactor authentication and a secure password change with an AND condition.

​
Risk

Without an active High user-risk policy that forces MFA and secure password reset, compromised identities can persist, enabling data exfiltration, tampering, and privilege escalation. Report-only mode or narrow scope leaves gaps, undermining confidentiality and integrity across resources.

​
Recommendation

Adopt least privilege by enabling an active user-risk policy that:
  • covers All users and apps (exclude only break-glass)
  • triggers on High user risk
  • requires MFA and a secure password change together
  • reauthenticates risky sessions
Pair with sign-in risk policies, ensure MFA registration, and review risky-user reports to validate effectiveness.

​
Remediation

resource "azuread_conditional_access_policy" "<example_resource_name>" {
  display_name = "<example_resource_name>"
  state        = "enabled"

  conditions {
    client_app_types = ["all"]
    users {
      include_users = ["All"] # Critical: targets all users
    }
    applications {
      included_applications = ["All"] # Critical: applies to all cloud apps
    }
    user_risk_levels = ["high"] # Critical: enforces on high user risk
  }

  grant_controls {
    operator          = "AND" # Critical: require all selected controls
    built_in_controls = ["mfa", "passwordChange"] # Critical: require MFA and password change
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = entra_identity_protection_user_risk_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Microsoft 365 checks