Guidance changes

Week of 2 Nov 2026

1. Entra Microsoft-managed Conditional Access policies

   Watch

   May need admin actionCheck whether a default changed for your tenant or devices; check the roles and permissions you grant.

   2 new passages (about 100 words), 1 edited passage (28 words changed).

   Changed in: Require remediation for high-risk users

   Changed wording view

   Inline diff Before After

   This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group [added: named “Conditional Access: User Risk remediation”] is created alongside this policy to scope the affected users. [added: Microsoft populates this group with eligible active users registered for MFA, up to the tenant’s available Microsoft Entra ID P2 license count.] Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation …

   Before: This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group is created alongside this policy to scope the affected users. Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation …

   After: This policy requires users identified as high risk by Microsoft Entra ID Protection to remediate their risk before continuing to access organizational resources. A new security group named “Conditional Access: User Risk remediation” is created alongside this policy to scope the affected users. Microsoft populates this group with eligible active users registered for MFA, up to the tenant’s available Microsoft Entra ID P2 license count. Instead of blocking access entirely, this policy uses adaptive risk remediation to guide users through the appropriate recovery flow based on their authentication method and the type of threat detected. For more information about the remediation experience, see User self-remediation …

   [added: Organizations that don't already have an enabled customer-managed Conditional Access policy targeting user risk. Microsoft skips tenants that already have an enabled customer-managed Conditional Access policy targeting user risk. Existing user risk policies in Report-only or Off state don't prevent this Microsoft-managed policy from being created. This check is specific to user risk policies, not all Conditional Access policies.]

   Before: No saved wording on this side.

   After: Organizations that don't already have an enabled customer-managed Conditional Access policy targeting user risk. Microsoft skips tenants that already have an enabled customer-managed Conditional Access policy targeting user risk. Existing user risk policies in Report-only or Off state don't prevent this Microsoft-managed policy from being created. This check is specific to user risk policies, not all Conditional Access policies.

   1 more changed passage · see them all

   Microsoft's commit: Update user risk remediation policy details

   Observed 4 Nov 09:01 UTC · current page · MIT

Quoted wording: © Microsoft Corporation · source and applicable license beside each change.