Conditional Access grant controls
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 06c08d8 · +11 −1 lines · also on GitHub
⋯ 4 unchanged lines
55
ms.service: entra-id
66
ms.subservice: conditional-access
77
ms.topic: concept-article
8
−ms.date: 09/22/2025
8
+ms.date: 10/30/2025
99
1010
ms.author: joflore
1111
author: MicrosoftGuyJFlo
⋯ 193 unchanged lines
205205
- The policy must be assigned to **All resources**. This requirement prevents an attacker from using a different app to change the user's password and resetting their account risk by signing in to a different app.
206206
- **Require password change** can't be used with other controls, such as requiring a compliant device.
207207
- The password change control can only be used with the user and group assignment condition, cloud app assignment condition (which must be set to "all"), and user risk conditions.
208
+
209
+### Require risk remediation
210
+
211
+When user risk is detected, users can self-remediate by completing the appropriate remediation flow, regardless of their authentication method. The Microsoft-managed remediation policy in Conditional Access accommodates all authentication methods, including password-based and passwordless. For more information, see [Require risk remediation with Microsoft-managed remediation (preview)](concept-identity-protection-policies.md#require-risk-remediation-with-microsoft-managed-remediation-preview).
212
+
213
+When you select **Require risk remediation** as a grant control, the following settings are automatically applied to the policy:
214
+- **Require authentication strength**
215
+- **Sign-in frequency - Every time**
216
+
217
+When a user is required to remediate risk with this control selected, users must sign in immediately after their sessions are revoked. Selecting this grant control means if the user just signed in but they're at risk, they'll be prompted to sign in again. The risk is remediated after the user successfully signs in the second time.
208218
209219
### Terms of use
210220
⋯ 23 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 03:16 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.