Detections
Analytics

5.2.2.8 Ensure 'sign-in risk' is blocked for medium and high risk

Information

Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account.

Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the "legacy method" for the following benefits:

 - Enhanced diagnostic data
 - Report-only mode integration
 - Graph API support
 - Use more Conditional Access attributes like sign-in frequency in the policy

Sign-in risk is determined at the time of sign-in and includes criteria across both real-time and offline detections for risk. Blocking sign-in to accounts that have risk can prevent undesired access from potentially compromised devices or unauthorized users.

Solution

To remediate using the UI:

 - Navigate to the Microsoft Entra admin center https://entra.microsoft.com.
 - Expand Entra ID > Conditional Access and select Policies.
 - Create a new policy by selecting New policy.

 - Under Users or agents (Preview) include All users.
 - Under Target resources include All resources (formerly 'All cloud apps') and do not set any exclusions.

 - Under Exclude exclude any break-glass accounts.

 - Under Conditions choose Sign-in risk values of High and Medium and click Done.
 - Under Grant choose Block access and click Select.

 - Under Enable policy set it to Report-only.
 - Click Create.
 - After allowing the policy to run in Report-only mode for at least one week, review the Sign-in logs for any unexpected impact, then return to the policy and set Enable policy to On.

Impact:

Sign-in risk is heavily dependent on detecting risk based on atypical behaviors. Due to this it is important to run this policy in a report-only mode to better understand how the organization's environment and user activity may influence sign-in risk before turning the policy on. Once it's understood what actions may trigger a medium or high sign-in risk event I.T. can then work to create an environment to reduce false positives. For example, employees might be required to notify security personnel when they intend to travel with intent to access work resources.

See Also

https://workbench.cisecurity.org/benchmarks/24620

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-6, 800-53|AU-6(1), 800-53|AU-7(1)

Plugin: microsoft_azure

Control ID: 923c26a4071d5e11a08a696cd05edaf709cfe353e5514f74c3f8954c285bd3d7