Detections
Analytics

MS.AAD.2.1v1 - Users detected as high risk SHALL be blocked.

Information

Blocking high-risk users may prevent compromised accounts from accessing the tenant.

Solution

1. Create a conditional access policy blocking users categorized as high risk by the Identity Protection service. Configure the following policy settings in the new conditional access policy as per the values below:

 Users > Include > All users

 Target resources > Include > All resources (formerly 'All cloud apps')

 Conditions > User risk > High

 Access controls > Grant > Block Access

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(12), 800-53|AC-2(13)

Plugin: microsoft_azure

Control ID: 513a42d44ec0cabcce0c18620f64a13f54e6f5b518a1b98b1720d2bd51913d8b