CIS.M365.5.2.2.6 - (L1) Enable Identity Protection user risk policies
Overview
An enabled Conditional Access policy responds to high user risk by requiring MFA and a password change, with sign-in frequency set to every time.
Microsoft Entra ID Protection marks an account as high risk when it has strong evidence that the credentials are leaked or the account is compromised. A policy that forces MFA and a password change lets the legitimate user recover automatically and gives the attacker nothing to reuse.
The policy needs Microsoft Entra ID P2 licences. Policies that also select medium or low risk are accepted, as long as high is included.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Conditions > User risk, set Configure to Yes and select High.
- Under Grant, select Grant access, then Require multifactor authentication and Require password change.
- Under Session, set Sign-in frequency to Every time.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Configure risk policies in Microsoft Entra ID Protection
- What is Microsoft Entra ID Protection
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.6
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.6 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.6 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.2.2.6, nist-800-53-r5:AC-2(12) |
| PowerShell test | Test-MtCisUserRiskPolicy |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.6.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.6.md