Microsoft-managed CA policy coming to your tenant: Require risk remediation for high-risk users

To strengthen your organization's security posture, Microsoft will create a new Microsoft-managed Conditional Access (CA) policy—Require risk remediation for high-risk users—in your tenant, along with a new security group for this policy. This policy uses Microsoft Entra ID Protection to identify users at high risk and prompts them to self-remediate through adaptive risk remediation, allowing users to resolve their own risk without administrator intervention. After creation, the policy will be in report-only mode for 30 days. If you take no action during this evaluation period, the policy will automatically switch to On. When this will happen The week of September 28, 2026: The Microsoft-managed CA policy will be created in report-only mode. The week of October 28, 2026: End of evaluation period - policy will be enforced (automatically switched to On) How this affects your organization Who is affected Organizations with Microsoft Entra ID P2 licenses. What will happen A new Microsoft-managed Require risk remediation for high-risk users CA policy will appear in report-only mode. If you do not set the policy to On or Off within 30 days, it will automatically turn On. When On, users identified as High User Risk will be prompted to self-remediate. After successful remediation, risk is cleared and access is restored. No existing Conditional Access settings or exclusions (such as break-glass accounts) will be altered. The policy will remain enabled by default unless customized. What you can do to prepare Review the policy in the Microsoft Entra admin portal once it appears. Decide whether to:Allow the policy to automatically turn on after 30 days, or Set it to Off if you do not want the policy enforced. Customize the policy as needed (for example, exclude emergency access accounts), or by modifying membership in the policy's security group. Ensure users are registered for multifactor authentication so they can complete self-remediation when prompted. If you need assistance, submit a support request: Technical → Microsoft Entra Sign-In and Multi-Factor Authentication → Conditional Access → Microsoft-managed Learn more: Microsoft-managed Conditional Access policies for enhanced security Require risk remediation for high-risk users User self-remediation with Microsoft Entra ID Protection What are risk detections? Compliance considerations No compliance considerations identified. Review as appropriate for your organization.