# (L2) Ensure 'sign-in risk' is blocked for medium and high risk An enabled Conditional Access policy blocks access when the sign-in risk is medium or high. Source: https://maester.dev/docs/tests/CIS.M365.5.2.2.8
jeremy finney
Contributed by jeremy finneyAll contributors →

Part of CIS · Entra ID · Conditional Access · All checks

```powershell title="Run this check" Invoke-Maester -TestId CIS.M365.5.2.2.8 ``` ## Overview An enabled Conditional Access policy blocks access when the sign-in risk is medium or high. Asking a risky sign-in for MFA still leaves the account open to an attacker who can complete the prompt, for example by relaying it. Blocking sign-ins that Microsoft Entra ID Protection rates medium or high stops them before a session exists, and users with a genuine need are sent to the helpdesk. The policy needs Microsoft Entra ID P2 licences. Expect some false positives, so involve the helpdesk before enabling it. User and group exclusions are not evaluated by this test. Application exclusions are also not evaluated when the policy targets all apps; verify exclusions are documented and reviewed annually. A condition that narrows the policy is reported unless the check is about that condition. #### Remediation action 1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com). 2. Go to **Entra ID** > **Conditional Access** > [**Policies**](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) and select **New policy**. 3. Under **Users**, include **All users**. Exclude your emergency access accounts. 4. Under **Target resources**, select **All resources (formerly All cloud apps)** without exclusions. 5. Under **Conditions** > **Sign-in risk**, set **Configure** to **Yes** and select **High** and **Medium**. 6. Under **Grant**, select **Block access**. 7. Set **Enable policy** to **On** (use **Report-only** first to measure the impact) and select **Create**. #### Related links * [Microsoft Entra admin center - Conditional Access policies](https://entra.microsoft.com/#view/Microsoft_AAD_ConditionalAccess/ConditionalAccessBlade/~/Policies) * [Configure risk policies in Microsoft Entra ID Protection](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-risk-policies) * [Risk-based access policies](https://learn.microsoft.com/entra/id-protection/concept-identity-protection-policies) * [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.2.8](https://www.cisecurity.org/benchmark/microsoft_365) ## Details
Every attribute of this check | Field | Value | | --- | --- | | Test ID | CIS.M365.5.2.2.8 | | Severity | Medium | | Suite | CIS | | Product | Entra ID | | Feature | Conditional Access | | Area | Access control | | Resource type | Tenant | | User impact | Medium | | Implementation cost | Medium | | MITRE ATT&CK | T1078.004 Cloud Accounts | | Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.2.8 | | Benchmark level | L2 | | Benchmark profiles | E5 Level 2 | | Supports controls | cis-m365:5.2.2.8, nist-800-53-r5:AC-2(12) | | PowerShell test | [Test-MtCisBlockMediumHighSignInRisk](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.8.ps1) | | Services | Graph | | Compatible licenses | AAD_PREMIUM_P2 |
## Source - Test: [`tests/cis/Test.CIS.M365.5.2.2.8.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.8.ps1) - Documentation: [`tests/cis/Test.CIS.M365.5.2.2.8.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.2.8.md)