Detections
Analytics

MS.AAD.2.3v1 - Sign-ins detected as high risk SHALL be blocked.

Information

This prevents compromised accounts from accessing the tenant.

Solution

1. Create a Conditional Access policy blocking sign-ins determined high risk by the Identity Protection service. Configure the following policy settings in the new Conditional Access policy as per the values below:

 Users > Include > All users

 Target resources > Include > All resources (formerly 'All cloud apps')

 Conditions > Sign-in risk > High

 Access controls > Grant > Block Access

See Also

https://github.com/cisagov/ScubaGear/tree/v1.8.0/

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(12), 800-53|AC-2(13)

Plugin: microsoft_azure

Control ID: b53014fe9b49dc7903c65bea30ca6f4ab93d83b058af3c916049b2e63298860e