Microsoft-managed Conditional Access policies

This page's changes and edits · All guidance changes

Microsoft's edit · 4 Nov 00:03 UTC

Update user risk remediation policy details

Microsoft's commit message in MicrosoftDocs/entra-docs · commit d7e2966 · +3 −2 lines · also on GitHub

⋯ 156 unchanged lines

157157

158158 ### Require remediation for high-risk users

159159

160 −This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group is created alongside this policy to scope the affected users. Instead of blocking access entirely, this policy uses [adaptive risk remediation](/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](/entra/id-protection/concept-identity-protection-user-experience).

160 +This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group named “Conditional Access: User Risk remediation” is created alongside this policy to scope the affected users. Microsoft populates this group with eligible active users registered for MFA, up to the tenant’s available Microsoft Entra ID P2 license count. Instead of blocking access entirely, this policy uses [adaptive risk remediation](/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](/entra/id-protection/concept-identity-protection-user-experience).

161161

162162 > [!NOTE]

163163 > **Hybrid tenants:** Eligible tenants have password hash sync enabled, so affected users can self-remediate through a secure password change after completing MFA. Ensure your users are registered for MFA. For more information, see [Considerations for cloud and hybrid users](/entra/id-protection/howto-identity-protection-remediate-unblock#considerations-for-cloud-and-hybrid-users).

⋯ 1 unchanged line

165165 This policy targets:

166166

167167 - Organizations with Microsoft Entra ID P2 licenses

168 +- Organizations that don't already have an enabled customer-managed Conditional Access policy targeting user risk. Microsoft skips tenants that already have an enabled customer-managed Conditional Access policy targeting user risk. Existing user risk policies in Report-only or Off state don't prevent this Microsoft-managed policy from being created. This check is specific to user risk policies, not all Conditional Access policies.

168169

169170 Key considerations:

170171

⋯ 2 unchanged lines

173174 - Authentication strength and sign-in frequency (every time) are automatically applied to ensure users reauthenticate with the required strength after session revocation.

174175 - This policy isn't supported for external and guest users.

175176

176 −Administrators can review policy impact in report-only mode, exclude emergency access accounts, and move the policy to On when ready.

177 +Administrators can review policy impact in report-only mode, exclude emergency access accounts, and turn the policy On before the scheduled enforcement date. If the policy remains in Report-only, Microsoft automatically enables it according to the schedule communicated to your tenant.

177178

178179 ## Upgrade from security defaults

179180

⋯ 120 unchanged lines

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 5 Nov 03:46 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.