CIS.M365.5.2.2.7 - (L1) Enable Identity Protection sign-in risk policies
Overview
An enabled Conditional Access policy responds to medium and high sign-in risk by requiring MFA every time or by blocking access.
Microsoft Entra ID Protection scores each sign-in on how likely it is that someone other than the account owner started it, for example an anonymous IP address, impossible travel or a leaked-credential match. A policy that responds to the score challenges or stops suspicious sign-ins even when the password is correct.
The policy needs Microsoft Entra ID P2 licences. Both medium and high must be selected. A policy that blocks access at those levels is stricter and is accepted.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps).
- Under Conditions > Sign-in risk, set Configure to Yes and select High and Medium.
- Under Grant, select Grant access and Require multifactor authentication.
- Under Session, set Sign-in frequency to Every time.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Configure risk policies in Microsoft Entra ID Protection
- Require MFA for risky sign-ins
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.7
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.7 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.7 |
| Benchmark level | L1 |
| Benchmark profiles | E5 Level 1 |
| Supports controls | cis-m365:5.2.2.7, nist-800-53-r5:AC-2(12) |
| PowerShell test | Test-MtCisSignInRiskPolicy |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.7.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.7.md