Microsoft Entra tenant with unsecure configuration of sign-in risk policy

To create sign-in risk policy in Conditional Access:

1. Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
2. Browse to Protection > Conditional Access.
3. Select New policy.
4. Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
5. Under Assignments, select Users.
   1. Under Include, select All users.
   2. Under Exclude, select Users and groups and choose your organization’s emergency access or break-glass accounts.
   3. Select Done.
6. Under Target resources > Include, select All cloud apps.
7. Under Conditions > Sign-in risk, set Configure to Yes. Under Select the sign-in risk level this policy will apply to. (This guidance is based on Microsoft recommendations and may be different for each organization)
   1. Select High and Medium.
   2. Select Done.
8. Under Access controls > Grant.
   1. Select Grant access, Require multifactor authentication.
   2. Select Select.
9. Under Session.
   1. Select Sign-in frequency.
   2. Ensure Every time is selected.
   3. Select Select.
10. Confirm your settings and set Enable policy to Report-only.
11. Select Create to create to enable your policy.

After confirming your settings using report-only mode, an administrator can move the Enable policy toggle from Report-only to On.