{
  "id": "CB-M365-AUTH-030",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-030",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-030.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-030.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-030",
    "title": "Block or force secure remediation for users at high risk",
    "finding": {
      "title": "Users flagged as high risk by ID Protection keep full access",
      "description": "An account that Microsoft considers likely compromised (leaked credentials, attacker activity) can still sign in and use the tenant."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "id-protection",
      "user-risk",
      "compromised-accounts"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "description": "A Conditional Access policy targets all users on all resources with the **User risk** condition\nset to **High**, and applies the action chosen in `{{ user_risk_action }}`:\n\n- `remediate`: grant access with **Require risk remediation** (an authentication strength is\n  selected with it, and **Sign-in frequency - Every time** is enforced). The user must perform a\n  secure password change, or for passwordless users a fresh strong sign-in, before going on. The\n  older combination **Require multifactor authentication** + **Require password change** is\n  accepted while it is still available.\n- `block`: **Block access**. An administrator investigates, then resets the password and dismisses\n  the risk.\n\nBoth options satisfy this control. The policy excludes only the emergency access accounts.\n",
    "rationale": "User risk aggregates signals that the account itself is compromised: credentials found in leaks,\nsign-ins from attacker infrastructure, token anomalies, Microsoft threat intelligence. Without a\npolicy, these detections only feed a report that nobody may read. Acting automatically shortens\nthe time an attacker can use the account from days to the next sign-in.\n",
    "impact": "With `remediate`, users must already be registered for MFA (and SSPR for password users),\notherwise they are blocked until an administrator helps. With `block`, every high-risk user\nwaits for the help desk or the security team; plan an on-call process. Password remediation\nneeds password writeback for synchronized users.\n",
    "notes": "Microsoft is rolling out Microsoft-managed policies for high-risk users (\"Block access for\nhigh-risk users\", \"Require remediation for high-risk users\"; message center MC1507808, end of\nOctober 2026). A managed policy left in **Report-only** is turned on by Microsoft after about 30\ndays. Review it: either keep it **On** as the policy that meets this control, or turn it **Off**\nif your own policy covers the same scope. When several risk policies apply, **Block** overrides\nremediation.\n",
    "parameters": [
      {
        "name": "user_risk_action",
        "type": "enum",
        "description": "Action for users at high risk. \"remediate\" requires a secure self-remediation, \"block\" blocks access until an administrator acts.",
        "default": "remediate",
        "allowed": [
          "remediate",
          "block"
        ]
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy (custom or Microsoft-managed) with **State** set to **On** where:\n   - **Users** > **Include** is **All users**, and **Exclude** contains only the emergency\n     access accounts or their group;\n   - **Target resources** includes **All resources**;\n   - **Conditions** > **User risk** includes **High**;\n   - **Grant** is **Block access**, or **Require risk remediation** (or **Require multifactor\n     authentication** + **Require password change**).\n4. Browse to **ID Protection** > **Risky users** and check that high-risk users do not stay in\n   the **At risk** state for long.\n5. Alternative in PowerShell (Microsoft Graph, scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.UserRiskLevels -contains 'high' } | Select-Object DisplayName, State, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`\n6. Fail if no enabled policy acts on high user risk for all users and all resources.\n"
    },
    "remediation": {
      "manual": "1. Make sure users are registered for MFA (CB-M365-AUTH-018) and, for password users, for SSPR\n   (CB-M365-AUTH-039).\n2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.\n3. If a Microsoft-managed high-risk user policy exists in **Report-only**, review its impact,\n   exclude the emergency access accounts and set it to **On**. Otherwise create a policy:\n4. **New policy**, name it for example `ALL - High user risk`.\n5. **Users** > **Include**: **All users**. **Exclude**: the emergency access accounts.\n6. **Target resources** > **Include**: **All resources**.\n7. **Conditions** > **User risk** > **Configure**: **Yes**, select **High**.\n8. **Grant**: for `remediate`, **Grant access** > **Require risk remediation** and pick an\n   authentication strength; for `block`, **Block access**.\n9. Set **Enable policy** to **Report-only**, review the sign-ins it would affect, then switch to\n   **On**.\n",
      "rollback": "Set the policy to **Report-only** or **Off**. Unblock a user by resetting the password and\ndismissing the risk in **ID Protection** > **Risky users**.\n"
    },
    "references": [
      {
        "title": "Require remediation for risky users",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-risk-based-user",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft-managed Conditional Access policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/managed-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.2.1v1",
        "relation": "looser",
        "note": "SCuBA requires blocking high-risk users; ours also accepts a secure self-remediation (parameter user_risk_action)."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-2(12)",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-031",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-018",
        "type": "requires"
      },
      {
        "id": "CB-M365-AUTH-039",
        "type": "related"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-008",
        "type": "related"
      },
      {
        "id": "CB-M365-AUDIT-010",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}