Detections
Analytics

5.2.2.8 (L2) Ensure 'sign-in risk' is blocked for medium and high risk

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.

Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the "legacy method" for the following benefits:

 - Enhanced diagnostic data
 - Report-only mode integration
 - Graph API support
 - Use more Conditional Access attributes like sign-in frequency in the policy

Sign-in risk is determined at the time of sign-in and includes criteria across both real-time and offline detections for risk. Blocking sign-in to accounts that have risk can prevent undesired access from potentially compromised devices or unauthorized users.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Click expand ID Protection > Risk-based Conditional Access.
 - Create a new policy by selecting New policy.
 - Set the following conditions within the policy.
 - Under Users include All users.
 - Under Target resources include All resources (formerly 'All cloud apps') and do not set any exclusions.
 - Under Conditions choose Sign-in risk values of High and Medium and click Done.
 - Under Grant choose Block access and click Select.

 - Under Enable policy set it to Report-only until the organization is ready to enable it.
 - Click Create.

Note: Break-glass accounts should be excluded from all Conditional Access policies.

Impact:

Sign-in risk is heavily dependent on detecting risk based on atypical behaviors. Due to this it is important to run this policy in a report-only mode to better understand how the organization's environment and user activity may influence sign-in risk before turning the policy on. Once it's understood what actions may trigger a medium or high sign-in risk event I.T. can then work to create an environment to reduce false positives. For example, employees might be required to notify security personnel when they intend to travel with intent to access work resources.

Note: Break-glass accounts should always be excluded from risk detection.

See Also

https://workbench.cisecurity.org/benchmarks/22162

Item Details

Plugin: microsoft_azure

Control ID: 97d35dfec540d8b73506c6a767ab89a4e08ddfbd9efa3a0ca61f57fbbd00a8d7