CIS.M365.5.2.2.8 - (L2) Ensure 'sign-in risk' is blocked for medium and high risk
Overview
An enabled Conditional Access policy blocks access when the sign-in risk is medium or high.
Asking a risky sign-in for MFA still leaves the account open to an attacker who can complete the prompt, for example by relaying it. Blocking sign-ins that Microsoft Entra ID Protection rates medium or high stops them before a session exists, and users with a genuine need are sent to the helpdesk.
The policy needs Microsoft Entra ID P2 licences. Expect some false positives, so involve the helpdesk before enabling it.
User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Conditional Access > Policies and select New policy.
- Under Users, include All users. Exclude your emergency access accounts.
- Under Target resources, select All resources (formerly All cloud apps) without exclusions.
- Under Conditions > Sign-in risk, set Configure to Yes and select High and Medium.
- Under Grant, select Block access.
- Set Enable policy to On (use Report-only first to measure the impact) and select Create.
Related links
- Microsoft Entra admin center - Conditional Access policies
- Configure risk policies in Microsoft Entra ID Protection
- Risk-based access policies
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.8
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.2.8 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Conditional Access |
| Area | Access control |
| Resource type | Tenant |
| User impact | Medium |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.8 |
| Benchmark level | L2 |
| Benchmark profiles | E5 Level 2 |
| Supports controls | cis-m365:5.2.2.8, nist-800-53-r5:AC-2(12) |
| PowerShell test | Test-MtCisBlockMediumHighSignInRisk |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.2.8.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.2.8.md