What this check looks at
Checks for an enabled Conditional Access policy for all users that blocks sign-ins rated medium or high risk, across all resources.
This is the strict form of the sign-in risk policy: instead of asking for MFA when ID Protection rates a sign-in medium or high risk, it refuses the sign-in outright. It needs Microsoft Entra ID P2.
The check looks for an enabled policy that targets All users and All resources with no resource excluded, applies when sign-in risk is High and Medium (both ticked), and blocks access. It warns when such a policy is only in report-only mode and fails when there is none.
MFA is no longer a certain stop. Adversary-in-the-middle phishing kits relay the MFA prompt to the victim and capture the session, and MFA-fatigue attacks wear people down until they approve a push. A sign-in ID Protection already finds risky that then passes MFA may well be one of these; blocking it removes the attacker’s chance, at the cost of sometimes blocking a genuine person who then calls the service desk.
Why it matters
Phishing kits now relay MFA too, so asking for MFA on a risky sign-in does not always stop the attacker. Blocking medium and high-risk sign-ins outright removes that chance, at the cost of the occasional genuine person calling the service desk.
A finance director receives a convincing secure-document email, enters their password on a relay site and approves the Authenticator prompt it triggers. The attacker’s sign-in comes from hosting infrastructure that ID Protection rates high risk. A policy asking for MFA lets the relayed approval through; a block gives the attacker an error and leaves a risky sign-in for IT to investigate.
The trade-off is real: travelling staff and people on consumer VPNs sometimes trigger medium risk. That is why the policy runs in report-only mode first and why the service desk needs a quick way to verify a blocked person and mark the sign-in safe. In most small organisations the number of genuine blocks is a handful a month.
The CIS Microsoft 365 Foundations Benchmark (5.2.2.8) asks for medium and high-risk sign-ins to be blocked, and the CISA SCuBA baseline (MS.AAD.2.3v1) asks for high-risk sign-ins to be blocked. The rule maps to NIST CSF 2.0 DE.CM-03.
How to fix it
Where: Entra admin centre → Protection → Conditional Access
Before you start
- Needs Entra ID P2. Run the policy in report-only mode for two weeks and check how many genuine sign-ins it would block, especially from travelling staff.
- Confirm two emergency access (break-glass) accounts exist and exclude them from the policy, so a mistake cannot lock every administrator out.
- Tell users what is changing and when, with a contact for problems.
Step by step
- Create the policy in report-only mode. In the Microsoft Entra admin centre, go to Entra ID > Conditional Access > Policies > New policy, named "CA – All users – Block medium and high sign-in risk". Users: All users, excluding the emergency access group. Target resources: All resources, with nothing under Exclude. Conditions > Sign-in risk: Configure Yes, tick High and Medium. Grant: Block access. Set Enable policy to Report-only and select Create.
- Leave it in report-only for two weeks and review. After about two weeks, open ID Protection > Risky sign-ins and the Report-only tab of matching sign-ins in Entra ID > Monitoring & health > Sign-in logs. Count how many genuine people it would have blocked, and from where.
- Reduce false positives at the source. Where genuine blocks come from known places, such as an office IP range or the company VPN, add them as named locations marked as trusted (Entra ID > Conditional Access > Named locations), which improves ID Protection’s risk scoring for them. Do not exclude people from the policy to make it fit.
- Prepare the service desk and tell staff. Write a short procedure: when someone reports being blocked, verify them on a known phone number, find the sign-in in ID Protection > Risky sign-ins and, if it was theirs, select Confirm sign-in safe so they can try again. Warn staff, especially frequent travellers, that an unusual sign-in may be blocked and whom to call.
- Switch the policy on. Check the emergency access group is still excluded, then set Enable policy to On and select Save.
- Confirm. Over the following days, risky sign-ins in the sign-in logs should show Failure with this policy on the Conditional Access tab. Re-run the assessment to confirm the finding passes.
What users will notice
Sign-ins rated medium or high risk are blocked outright; the person contacts IT, who can confirm the sign-in was safe.
How to confirm it worked
Sign-in logs show risky sign-ins as "Failure" with this policy listed; the policy state is On.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | C1.c Generating alertsB2.a Identity verification, authentication and authorisation |
| DSPT | Standard 9: IT protection |
| DORA | Art. 10 Detection of anomalous activities |
| NIS2 | Art. 21(2)(b) Incident handling |
| Microsoft Cloud Security Benchmark | LT-2 Enable threat detection for identity and access managementIM-7 Restrict resource access based on conditions |
| Zero Trust | Identities |
| SOC 2 | CC7.2 Monitoring system components for anomalies |
| NIST SP 800-171 | 3.14.7 Identify unauthorised use of systems |
| CMMC Level 2 | SI.L2-3.14.7 Identify Unauthorized Use |
| ISO 27001:2022 | A.8.16 Monitoring activitiesA.8.5 Secure authentication |
| CISA SCuBA | MS.AAD.2.3v1 Sign-ins detected as high risk blocked |
| CIS M365 | 5.2.2.8 Ensure 'sign-in risk' is blocked for medium and high risk |
| CIS Controls v8.1 | 6.3 Require MFA for externally-exposed applications (IG1) |
| NIST CSF 2.0 | DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events |
| NCSC 10 Steps | Identity and access managementLogging and monitoring |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Risk-based policies (Microsoft Learn)