Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit 5faaf56 · +21 −0 lines · also on GitHub
⋯ 54 unchanged lines
5555
- [Multifactor authentication for per-user multifactor authentication users](#multifactor-authentication-for-per-user-multifactor-authentication-users)
5656
- [Multifactor authentication and reauthentication for risky sign-ins](#multifactor-authentication-and-reauthentication-for-risky-sign-ins)
5757
- [Block access for high-risk users](#block-access-for-high-risk-users)
58
+- [Require remediation for high-risk users](#require-remediation-for-risky-users)
5859
- [Require phishing resistant authentication for admins](/microsoft-365/baseline-security-mode/baseline-security-mode-settings) (Baseline security mode policy)
5960
6061
## How to access and manage Microsoft-managed policies
⋯ 91 unchanged lines
152153
- Organizations with Microsoft Entra ID P2 licenses
153154
- Organizations where security defaults aren't enabled
154155
156
+Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.
157
+
158
+### Require remediation for high-risk users
159
+
160
+This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. Instead of blocking access entirely, this policy uses [adaptive risk remediation](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-user-experience).
161
+
162
+> [!NOTE]
163
+> **Hybrid tenants:** Eligible tenants have password hash sync enabled, so affected users can self-remediate through a secure password change after completing MFA. Ensure your users are registered for MFA. For more information, see [Considerations for cloud and hybrid users](https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-remediate-unblock#considerations-for-cloud-and-hybrid-users).
164
+
165
+This policy targets:
166
+
167
+- Organizations with Microsoft Entra ID P2 licenses
168
+
169
+Key considerations:
170
+
171
+- This policy remediates user risk, not sign-in risk.
172
+- If a user is assigned to multiple risk policies, precedence applies: Require risk remediation overrides Require password change, and Block overrides all others.
173
+- Authentication strength and sign-in frequency (every time) are automatically applied to ensure users reauthenticate with the required strength after session revocation.
174
+- This policy isn't supported for external and guest users.
175
+
155176
Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.
156177
157178
## Upgrade from security defaults
⋯ 121 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.