rules/findings/entra/conditional_access/eid-cap-user-risk-policy-require-password-change.json
|
{
"provider": "EntraID", "serviceType": "Conditional Access", "serviceName": "Microsoft Entra ID", "displayName": "Enable Entra ID Identity Protection user risk policies", "description": "\r\n\t\tMicrosoft Entra ID Protection user risk policies detect the probability that a user account has been compromised. \r\n\t\t**Note** : While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the `legacy method` for the following benefits: \r\n\t\t* Enhanced diagnostic data \r\n\t\t* Report-only mode integration \r\n\t\t* Graph API support \r\n\t\t* Use more Conditional Access attributes like sign-in frequency in the policy \r\n ", "rationale": "With the user risk policy turned on, Entra ID protection detects the probability that a user account has been compromised. Administrators can configure a user risk conditional access policy to automatically respond to a specific user risk level.", "impact": "Upon policy activation, account access will be either blocked or the user will be required to use multi-factor authentication (MFA) and change their password. Users without registered MFA will be denied access, necessitating an admin to recover the account. To avoid inconvenience, it is advised to configure the MFA registration policy for all users under the User Risk policy. Additionally, users identified in the Risky Users section will be affected by this policy. To gain a better understanding of the impact on the organization\u0027s environment, the list of Risky Users should be reviewed before enforcing the policy.", "remediation": { "text": "###### From Azure Console\r\n\t\t\t\t\t1. From Azure Home open the Portal Menu in top left, and select Microsoft Entra ID\r\n\t\t\t\t\t2. Scroll down in the menu on the left, and select `Security`\r\n\t\t\t\t\t3. Select on the left side `Conditional Access`\r\n\t\t\t\t\t4. Click the `+ New policy`", "code": { "powerShell": null, "iac": null, "terraform": null, "other": null } }, "recommendation": null, "references": [ "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-identity-protection-risk-feedback", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks" ], "compliance": [ { "name": "CIS Microsoft 365 Foundations Benchmark", "version": "6.1.0", "reference": "5.2.2.6", "profile": [ "E5 Level 1" ] } ], "level": "medium", "tags": [ ], "rule": { "path": "aad_conditional_access_policy", "subPath": null, "selectCondition": { }, "query": [ { "filter": [ { "conditions": [ [ "state", "eq", "enabled" ], [ "conditions.users.includeUsers", "eq", "All" ], [ "conditions.applications.includeApplications", "eq", "All" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "MicrosoftAdminPortals", "notin", "conditions.applications.excludeApplications" ], [ "Office365", "notin", "conditions.applications.excludeApplications" ] ], "operator": "or" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "conditions.userRiskLevels", "match", "high" ] ] } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "grantControls.operator", "eq", "AND" ], [ "grantControls.builtInControls", "match", "mfa|passwordChange" ] ], "operator": "and" } ] }, { "connectOperator": "and", "filter": [ { "conditions": [ [ "sessionControls.signInFrequency.isEnabled", "eq", "true" ], [ "sessionControls.signInFrequency.frequencyInterval", "eq", "everyTime" ] ], "operator": "and" } ] } ], "shouldExist": "true", "returnObject": null, "removeIfNotExists": null }, "output": { "html": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeUsers": "Users", "conditions.userRiskLevels": "User Risk Levels", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "table": null, "decorate": [ ], "emphasis": [ ], "actions": { "objectData": { "properties": [ "*" ], "expandObject": null, "limit": null }, "showGoToButton": false, "showModalButton": false, "directLink": null } }, "text": { "data": { "properties": { "displayName": "Name", "state": "Status", "conditions.applications.includeApplications": "Applications", "conditions.users.includeUsers": "Users", "conditions.userRiskLevels": "User Risk Levels", "grantControls.operator": "Operator", "grantControls.builtInControls": "BuiltIn Controls" }, "expandObject": null }, "status": { "keyName": [ ], "message": "Enable Entra ID Identity Protection user risk policies", "defaultMessage": null }, "properties": { "resourceName": "displayName", "resourceId": "id", "resourceType": "EntraConditionalAccess" }, "onlyStatus": true } }, "idSuffix": "aad_cap_user_risk_policy", "notes": [ ], "categories": [ ], "immutable_properties": [ "id" ], "id": "entraid_1119" } |