{
  "id": "CB-M365-AUDIT-010",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-010",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-010.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUDIT-010.yml",
  "profiles_effective": [
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUDIT-010",
    "title": "Notify administrators when high-risk users are detected",
    "finding": {
      "title": "Nobody is notified when Microsoft Entra ID Protection flags a user as high risk",
      "description": "A likely compromised account can stay active for days because the risk detection sits in a report nobody watches."
    },
    "status": "active",
    "profiles": [
      "hardened"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "identity-protection",
      "alerting",
      "risky-users",
      "monitoring",
      "entra-id"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "description": "The Microsoft Entra ID Protection **Users at risk detected** email alert is configured with the\nrisk level **High** (or lower) and recipients that include the security team's monitored\nmailbox, not only the role holders added by default. The **Weekly digest** email is on with the\nsame recipients.\n",
    "rationale": "Risk-based Conditional Access (CB-M365-AUTH-030) blocks or remediates a risky user, but the\nsecurity team still needs to investigate what the attacker did before the block and whether\nother accounts are involved. By default the alert goes only to active Global Administrators,\nSecurity Administrators and Security Readers with a mailbox; with PIM, they often receive\nnothing.\n",
    "impact": "None known. Recipients need permission to view the linked ID Protection reports.\n",
    "notes": "Users at risk can also be forwarded to the SIEM through the `RiskyUsers` and `UserRiskEvents`\ndiagnostic categories (CB-M365-AUDIT-002), which is the preferred channel when a SOC exists.\n",
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **ID Protection** > **Dashboard** > **Users at risk detected alerts**.\n3. Check that the alert is set to **High** (or a lower level) and that the recipient list includes\n   a monitored security mailbox or distribution list.\n4. Browse to **ID Protection** > **Dashboard** > **Weekly digest** and check it is on with the\n   same recipients.\n5. Fail if the alert has no monitored recipient other than individual role holders, or if the\n   weekly digest is off.\n"
    },
    "remediation": {
      "manual": "1. Sign in to the Microsoft Entra admin center as at least a Security Administrator.\n2. Browse to **ID Protection** > **Dashboard** > **Users at risk detected alerts**, set the risk\n   level to **High** (or **Medium**), add the security team's mailbox under **Add custom email\n   here**, and save.\n3. Browse to **Weekly digest**, turn it on, add the same mailbox, and save.\n",
      "rollback": "Remove the custom recipient or turn the weekly digest off.\n"
    },
    "references": [
      {
        "title": "Configure Microsoft Entra ID Protection notifications",
        "url": "https://learn.microsoft.com/entra/id-protection/howto-identity-protection-configure-notifications",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.2.2v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4(5)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IR-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUDIT-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-030",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}