Notify administrators when high-risk users are detected

Description

The Microsoft Entra ID Protection Users at risk detected email alert is configured with the risk level High (or lower) and recipients that include the security team's monitored mailbox, not only the role holders added by default. The Weekly digest email is on with the same recipients.

Users at risk can also be forwarded to the SIEM through the RiskyUsers and UserRiskEvents diagnostic categories (CB-M365-AUDIT-002), which is the preferred channel when a SOC exists.

Rationale

Risk-based Conditional Access (CB-M365-AUTH-030) blocks or remediates a risky user, but the security team still needs to investigate what the attacker did before the block and whether other accounts are involved. By default the alert goes only to active Global Administrators, Security Administrators and Security Readers with a mailbox; with PIM, they often receive nothing.

Impact

None known. Recipients need permission to view the linked ID Protection reports.

Applies when

Requires: Microsoft Entra ID P2

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to ID Protection > Dashboard > Users at risk detected alerts.
3. Check that the alert is set to High (or a lower level) and that the recipient list includes a monitored security mailbox or distribution list.
4. Browse to ID Protection > Dashboard > Weekly digest and check it is on with the same recipients.
5. Fail if the alert has no monitored recipient other than individual role holders, or if the weekly digest is off.

Remediation

1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.
2. Browse to ID Protection > Dashboard > Users at risk detected alerts, set the risk level to High (or Medium), add the security team's mailbox under Add custom email here, and save.
3. Browse to Weekly digest, turn it on, add the same mailbox, and save.

Rollback

Remove the custom recipient or turn the weekly digest off.

References

• Configure Microsoft Entra ID Protection notifications Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUDIT-002 Forward Microsoft 365 security logs to the SIEM or SOC
• related CB-M365-AUTH-030 Block or force secure remediation for users at high risk

People and lifecycle