{
  "id": "CB-M365-AUTH-031",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-031",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-031.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-AUTH-031.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-AUTH-031",
    "title": "Require MFA for risky sign-ins and block sign-ins at the highest risk levels",
    "finding": {
      "title": "Risky sign-ins detected by ID Protection are not challenged or blocked",
      "description": "A sign-in that looks like password spray, token replay or an anonymizing proxy goes through like any other."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "high"
    },
    "assessment": "manual",
    "tags": [
      "conditional-access",
      "id-protection",
      "sign-in-risk",
      "mfa"
    ],
    "applicability": {
      "requires": [
        "Microsoft Entra ID P2"
      ]
    },
    "description": "Two Conditional Access policies act on the **Sign-in risk** condition, for all users on all\nresources, excluding only the emergency access accounts:\n\n1. Sign-in risk **Medium** and **High**: grant access with **Require authentication strength**\n   (at least the built-in **Multifactor authentication** strength) and the session control\n   **Sign-in frequency - Every time**, so the user must complete a new MFA for that sign-in.\n2. Sign-in risk in {{ signin_risk_block_levels }}: **Block access**.\n\nThe baseline profile blocks high-risk sign-ins; the hardened profile blocks medium and high.\n",
    "rationale": "Sign-in risk is computed in real time for each authentication: unfamiliar properties, atypical\ntravel, anonymous IP addresses, password spray patterns, known attacker infrastructure. Asking for\nMFA stops an attacker who only has the password. Blocking the riskiest sign-ins also stops an\nattacker who relays or fatigues the MFA prompt.\n",
    "impact": "Users on a medium-risk sign-in see an extra MFA prompt. Users who are not registered for MFA are\nblocked on risky sign-ins (error AADSTS53004), because registration is refused during a risky\nsession. Blocking medium risk (hardened) produces more false positives, for example on travel or\nnew VPN egress points; have a quick unblock procedure.\n",
    "notes": "Microsoft deploys a Microsoft-managed policy \"Multifactor authentication and reauthentication for\nrisky sign-ins\" for high risk. It meets part 1 for high risk only; it does not block. Review it\nas described in CB-M365-AUTH-030.\n",
    "parameters": [
      {
        "name": "signin_risk_block_levels",
        "type": "list",
        "description": "Sign-in risk levels that are blocked outright (values low, medium, high).",
        "default": [
          "high"
        ],
        "profile_defaults": {
          "hardened": [
            "medium",
            "high"
          ]
        }
      }
    ],
    "audit": {
      "manual": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a\n   Security Reader.\n2. Browse to **Entra ID** > **Conditional Access** > **Policies**.\n3. Find a policy with **State** **On**, **All users** (emergency access excluded), **All\n   resources**, **Conditions** > **Sign-in risk** with **Medium** and **High**, **Grant**\n   requiring MFA or an authentication strength, and **Session** > **Sign-in frequency** **Every\n   time**.\n4. Find a policy with **State** **On**, same users and resources, **Sign-in risk** including\n   every level in {{ signin_risk_block_levels }}, and **Grant** **Block access**.\n5. Alternative in PowerShell (Microsoft Graph, scope `Policy.Read.All`):\n   `Get-MgIdentityConditionalAccessPolicy | Where-Object { $_.Conditions.SignInRiskLevels } | Select-Object DisplayName, State, @{n='Risk';e={$_.Conditions.SignInRiskLevels}}, @{n='Grant';e={$_.GrantControls.BuiltInControls}}`\n6. Fail if medium-risk sign-ins are not challenged, or if a level of\n   {{ signin_risk_block_levels }} is not blocked.\n"
    },
    "remediation": {
      "manual": "1. Make sure users are registered for MFA (CB-M365-AUTH-018).\n2. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.\n3. Create the MFA policy: **New policy**, **Users** > **All users** (exclude the emergency\n   access accounts), **Target resources** > **All resources**, **Conditions** > **Sign-in risk**\n   > **Configure** **Yes**, select **High** and **Medium**; **Grant** > **Require authentication\n   strength** > **Multifactor authentication**; **Session** > **Sign-in frequency** > **Every\n   time**.\n4. Create the block policy: same assignments, **Sign-in risk** set to\n   {{ signin_risk_block_levels }}, **Grant** > **Block access**.\n5. Start both in **Report-only**, review the affected sign-ins, then switch to **On**.\n",
      "rollback": "Set the policies to **Report-only** or **Off**. Unblock a user by confirming the sign-in as safe\nin **ID Protection** > **Risky sign-ins**.\n"
    },
    "references": [
      {
        "title": "Sign-in risk-based multifactor authentication",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/policy-risk-based-sign-in",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Microsoft-managed Conditional Access policies",
        "url": "https://learn.microsoft.com/entra/identity/conditional-access/managed-policies",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "CISA SCuBA Microsoft Entra ID baseline",
        "url": "https://github.com/cisagov/ScubaGear/blob/main/PowerShell/ScubaGear/baselines/aad.md",
        "publisher": "CISA",
        "kind": "standard",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "cisa-scuba-m365",
        "framework_version": "2.0.0",
        "id": "MS.AAD.2.3v1",
        "relation": "equivalent"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "IA-10",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "SI-4",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1110.003"
      },
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      },
      {
        "framework": "mitre-attack",
        "id": "T1557"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-AUTH-030",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-018",
        "type": "requires"
      },
      {
        "id": "CB-M365-ADMIN-002",
        "type": "related"
      },
      {
        "id": "CB-M365-APPS-018",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}