High-risk users should not be left unremediated in Entra ID Protection
Part of Maester · Entra ID · Identity Protection · All checks
Invoke-Maester -TestId MT.1260 -IncludePreviewOverview
Section titled “Overview”High-risk users should not be left unremediated in Entra ID Protection.
Entra ID Protection rates a user’s risk and tracks a risk state for each flagged user. A high-risk flag only clears when the risk is remediated, for example by a password reset, or when an admin dismisses it or confirms the user safe. Until then the account stays exposed: the signals that triggered the flag have not been addressed.
This check reports users whose risk level is high and whose risk state is still active and unremediated (atRisk or confirmedCompromised). States that represent a handled flag (remediated, dismissed, confirmedSafe, none) are not reported. The check reads risk only and never changes a user’s risk state.
If a reported user holds a privileged directory role, active or PIM-eligible, the result lists the role and the severity is raised to High, since a compromised admin account puts the whole tenant at risk.
The check needs the Microsoft Graph permission IdentityRiskyUser.Read.All, which Maester does not request by default. Without it the check is skipped. Connect with Connect-Maester -IncludePreview, or grant the permission to the app registration that runs Maester.
A companion check, MT.1261, is planned to report on medium-risk users. This check is about the outcome (users actually left unremediated). It is complementary to MT.1253, which checks that a Conditional Access policy requiring risk remediation is in place; one checks the control, this one checks the result.
Remediation action
Section titled “Remediation action”- Open the Microsoft Entra admin center and navigate to Protection > Identity Protection > Risky users.
- Locate each reported user by their user principal name. Start with any user listed with a privileged role.
- Investigate the risk detections behind the flag and decide whether the account is compromised.
- Remediate the risk by the appropriate path:
- If compromised, require a password reset, revoke the user’s refresh tokens, and review recent sign-ins and activity.
- If the activity is confirmed safe after investigation, dismiss the user’s risk or confirm the user safe so the flag clears.
- Consider a risk-based Conditional Access policy so that future high-risk users are remediated automatically rather than left waiting for manual review.
Related links
Section titled “Related links”- Remediate risks and unblock users
- Investigate risk with Microsoft Entra ID Protection
- What is risk in Microsoft Entra ID Protection
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | MT.1260 |
| Severity | Medium |
| Suite | Maester |
| Product | Entra ID |
| Feature | Identity Protection |
| Area | Logging and detection |
| Resource type | User |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:AC-2(12), nist-800-53-r5:IR-4 |
| PowerShell test | Test-MtEntraUnremediatedHighRiskUser |
| Services | Graph |
| Compatible licenses | AAD_PREMIUM_P2 |
| Permissions | Graph:Scope:IdentityRiskyUser.Read.All |
| Lifecycle | Preview |
Source
Section titled “Source”- Test:
tests/maester/entra/Test.MT.1260.ps1 - Documentation:
tests/maester/entra/Test.MT.1260.md