Check provider logo

At least one Conditional Access policy enforces Identity Protection user risk for high-risk users

entra_identity_protection_user_risk_enabled

Severityhigh
Serviceentra
by Prowler
identity-accesse5

Microsoft Entra Conditional Access has a user risk-based policy that targets All users and All applications, evaluates High user risk, and actively enforces controls requiring both multifactor authentication and a secure password change with an AND condition.

Risk

Without an active High user-risk policy that forces MFA and secure password reset, compromised identities can persist, enabling data exfiltration, tampering, and privilege escalation. Report-only mode or narrow scope leaves gaps, undermining confidentiality and integrity across resources.

Run this check with Prowler CLI

prowler m365 --checks entra_identity_protection_user_risk_enabled

Run in Prowler Cloud

Recommendation

Adopt least privilege by enabling an active user-risk policy that:

  • covers All users and apps (exclude only break-glass)
  • triggers on High user risk
  • requires MFA and a secure password change together
  • reauthenticates risky sessions

Pair with sign-in risk policies, ensure MFA registration, and review risky-user reports to validate effectiveness.

Remediation

Terraform
Other
  1. Sign in to the Microsoft Entra admin center and go to Protection > Conditional Access > Policies
  2. Click New policy
  3. Users or workload identities: select All users
  4. Target resources (Cloud apps): select All cloud apps
  5. Conditions > User risk: set Configure to Yes and select High
  6. Access controls > Grant: select Grant access, then check Require multifactor authentication and Require password change; set Require all selected controls
  7. Enable policy: On, then click Create

Source Code

Resource Type

NotDefined

References