Require MFA for risky sign-ins and block sign-ins at the highest risk levels

Description

Two Conditional Access policies act on the Sign-in risk condition, for all users on all resources, excluding only the emergency access accounts:

1. Sign-in risk Medium and High: grant access with Require authentication strength (at least the built-in Multifactor authentication strength) and the session control Sign-in frequency - Every time, so the user must complete a new MFA for that sign-in.
2. Sign-in risk in {{ signin_risk_block_levels }}: Block access.

The baseline profile blocks high-risk sign-ins; the hardened profile blocks medium and high.

Microsoft deploys a Microsoft-managed policy "Multifactor authentication and reauthentication for risky sign-ins" for high risk. It meets part 1 for high risk only; it does not block. Review it as described in CB-M365-AUTH-030.

Rationale

Sign-in risk is computed in real time for each authentication: unfamiliar properties, atypical travel, anonymous IP addresses, password spray patterns, known attacker infrastructure. Asking for MFA stops an attacker who only has the password. Blocking the riskiest sign-ins also stops an attacker who relays or fatigues the MFA prompt.

Impact

Users on a medium-risk sign-in see an extra MFA prompt. Users who are not registered for MFA are blocked on risky sign-ins (error AADSTS53004), because registration is refused during a risky session. Blocking medium risk (hardened) produces more false positives, for example on travel or new VPN egress points; have a quick unblock procedure.

Applies when

Requires: Microsoft Entra ID P2

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Security Reader.
2. Browse to Entra ID > Conditional Access > Policies.
3. Find a policy with State On, All users (emergency access excluded), All resources, Conditions > Sign-in risk with Medium and High, Grant requiring MFA or an authentication strength, and Session > Sign-in frequency Every time.
4. Find a policy with State On, same users and resources, Sign-in risk including every level in {{ signin_risk_block_levels }}, and Grant Block access.
5. Alternative in PowerShell (Microsoft Graph, scope Policy.Read.All): Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.SignInRiskLevels } | Select-Object DisplayName, State, @{n='Risk';e={$_.Conditions.SignInRiskLevels}}, @{n='Grant';e={$_.GrantControls.BuiltInControls}}
6. Fail if medium-risk sign-ins are not challenged, or if a level of {{ signin_risk_block_levels }} is not blocked.

Remediation

1. Make sure users are registered for MFA (CB-M365-AUTH-018).
2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
3. Create the MFA policy: New policy, Users > All users (exclude the emergency access accounts), Target resources > All resources, Conditions > Sign-in risk

   Configure Yes, select High and Medium; Grant > Require authentication strength > Multifactor authentication; Session > Sign-in frequency > Every time.

4. Create the block policy: same assignments, Sign-in risk set to {{ signin_risk_block_levels }}, Grant > Block access.
5. Start both in Report-only, review the affected sign-ins, then switch to On.

Rollback

Set the policies to Report-only or Off. Unblock a user by confirming the sign-in as safe in ID Protection > Risky sign-ins.

References

• Sign-in risk-based multifactor authentication Microsoft, vendor-doc, accessed 2026-10-24
• Microsoft-managed Conditional Access policies Microsoft, vendor-doc, accessed 2026-10-24
• CISA SCuBA Microsoft Entra ID baseline CISA, standard, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-030 Block or force secure remediation for users at high risk
• requires CB-M365-AUTH-018 Make sure every member user has registered an MFA method
• related CB-M365-ADMIN-002 Keep two protected emergency access accounts
• related CB-M365-APPS-018 Block high-risk AI agents with Conditional Access

People and lifecycle