Microsoft-managed Conditional Access policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/entra-docs · commit e876507 · +4 −4 lines · also on GitHub
⋯ 32 unchanged lines
3333
- The policy includes preconfigured conditions and recommended controls, such as requiring multifactor authentication.
3434
- Administrators don't need to manually create these policies. Microsoft manages the policy template, configuration, and updates to ensure it aligns with current security guidance.
3535
36
−Microsoft enables these policies no less than 45 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 28 days before the policies are enabled.
36
+Microsoft enables these policies no less than 30 days after they're introduced in your tenant if they're left in the **Report-only** state. You can turn on these policies sooner, or opt out by setting the policy state to **Off**. Customers are notified through emails and [Message center](/microsoft-365/admin/manage/message-center) posts 2 weeks before the policies are enabled.
3737
3838
> [!NOTE]
39
−> In some cases, policies might be enabled faster than 45 days. If this change applies to your tenant:
39
+> In some cases, policies might be enabled faster than 30 days. If this change applies to your tenant:
4040
>
4141
> - It's mentioned in emails and Microsoft 365 message center posts you receive about Microsoft-managed policies.
4242
> - It's mentioned in the policy details in the Microsoft Entra admin center.
⋯ 114 unchanged lines
157157
158158
### Require remediation for high-risk users
159159
160
−This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. Instead of blocking access entirely, this policy uses [adaptive risk remediation](https://learn.microsoft.com/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](https://learn.microsoft.com/entra/id-protection/concept-identity-protection-user-experience).
160
+This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group is created alongside this policy to scope the affected users. Instead of blocking access entirely, this policy uses [adaptive risk remediation](/entra/id-protection/concept-identity-protection-user-experience) to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see [User self-remediation with Microsoft Entra ID Protection](/entra/id-protection/concept-identity-protection-user-experience).
161161
162162
> [!NOTE]
163
−> **Hybrid tenants:** Eligible tenants have password hash sync enabled, so affected users can self-remediate through a secure password change after completing MFA. Ensure your users are registered for MFA. For more information, see [Considerations for cloud and hybrid users](https://learn.microsoft.com/entra/id-protection/howto-identity-protection-remediate-unblock#considerations-for-cloud-and-hybrid-users).
163
+> **Hybrid tenants:** Eligible tenants have password hash sync enabled, so affected users can self-remediate through a secure password change after completing MFA. Ensure your users are registered for MFA. For more information, see [Considerations for cloud and hybrid users](/entra/id-protection/howto-identity-protection-remediate-unblock#considerations-for-cloud-and-hybrid-users).
164164
165165
This policy targets:
166166
⋯ 133 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 01:29 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.