Detections
Analytics

MS.AAD.2.2v1 - A notification SHOULD be sent to the administrator when high-risk users are detected.

Information

Notification enables the admin to monitor the event and remediate the risk. This helps the organization proactively respond to cyber intrusions as they occur.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

1. [Configure Microsoft Entra ID Protection to send a regularly monitored security mailbox email notification](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-notifications#configure-users-at-risk-detected-alerts) when user accounts are determined to be high risk.

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(12)

Plugin: microsoft_azure

Control ID: dbc96da4d27bfe4b7deefc8ec9883a765239793d3ad2fb9d1d5620bb6743b4b2