Contact Sales
+1 (614) 423-6718
Support
Blog
Partners
Downloads

Microsoft Entra tenant with unsecure configuration of user risk policy

Home > Threat Library > Microsoft Entra tenant with unsecure configuration of user risk policy

Microsoft Entra tenant with unsecure configuration of user risk policy

Cayosoft Threat Definition CTD-000101

Table of Contents

Risk Summary
Description
Real-World Scenario
How to Detect (Cayosoft Guardian)
Remediation Steps
How to Prevent It
FAQ
References
Final Thought
Protect Your Active Directory

Tune into Guardians of the Directory Podcast.

Guardians of the Directory
YouTube
Spotify
Apple

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Download for free

Like This Article?​

Subscribe to our LinkedIn Newsletter to receive more educational content

Subscribe now

Risk Summary

If the user risk policy is missing or too permissive, compromised accounts can continue authenticating. Microsoft recommends requiring a secure password change when user risk is High, with MFA before password writeback.

  • Severity: Medium
  • Platform: Entra ID
  • Category: Account protection, Tenant-wide
  • MITRE ATT&CK Tactics: Credential Access
  • MITRE D3FEND Tactics: Application Configuration Hardening

Description

Identity Protection analyzes signals (e.g., risky sign-ins, leaked credentials) to calculate a user risk level. Administrators can enforce access controls via Conditional Access based on user risk, including blocking access or allowing access only after a secure password change. Requiring a secure password change remediates user risk and closes the risky user event, reducing alert noise for administrators.

Cayosoft Guardian Protector™

Real-World Scenario

An attacker obtains a user’s credentials from a public dump. Identity Protection flags the account as High user risk, but the tenant lacks a Conditional Access user risk policy requiring a secure password change. The attacker keeps accessing Exchange Online and SharePoint while the risk remains open, exfiltrating sensitive files. Helpdesk resets the password without MFA-backed proof of possession, and the attacker quickly re-enters via a remembered session token. Cayosoft Guardian detects CTD-000101 and alerts the team so they can enforce a High-risk password change policy and contain the breach.

Stop Privilege Escalation—Then Undo It with Cayosoft Guardian

Real-time alerts across AD & Entra ID with one-click rollback.

See it in action

How to Detect (Cayosoft Guardian)

1.) Sign in to Cayosoft Guardian Threat Detection Dashboard.

2.) Open All Alerts and search for CTD-000101 or “Microsoft Entra tenant with unsecure configuration of user risk policy.”

3.) Open any alert and Click for details (from Raise Threat Alert action).

Remediation Steps

Using the remediation advice in Cayosoft Guardian, follow these steps to remove the vulnerability:

To create a user risk policy in Conditional Access:

  1. ) Sign in to the Microsoft Entra admin center as at least a Conditional Access Administrator.
  2. ) Browse to Protection > Conditional Access.
  3. ) Select New policy.
  4. ) Give your policy a name. We recommend that organizations create a meaningful standard for the names of their policies.
  5. ) Under Assignments, select Users.
    1. ) Under Include, select All users.
    2. ) Under Exclude, select Users and groups and choose your organization’s emergency access or break-glass accounts.
    3. ) Select Done.
  6. ) Under Target resources > Include, select All cloud apps.
  7. ) Under Conditions > User risk, set Configure to Yes.
    1. ) Under Configure user risk levels needed for policy to be enforced, select High. (This guidance is based on Microsoft recommendations and may be different for each organization).
    2. ) Select Done.
  8. ) Under Access controls > Grant.
    1. ) Select Grant access, Require multifactor authentication and Require password change.
    2. ) Select Select.
  9. ) Under Session.
    1. ) Select Sign-in frequency.
    2. ) Ensure Every time is selected.
    3. ) Select Select.
  10. ) Confirm your settings and set Enable policy to On.
  11. ) Select Create to create to enable your policy.

How to Prevent It

Cayosoft Guardian can proactively detect and alert on Microsoft Entra tenant with unsecure configuration of user risk policy. It continuously monitors Active Directory, Entra ID, Microsoft 365, and Intune for 200+ misconfigurations, providing early warning before attackers can exploit them.

FAQ

Microsoft recommends enforcing a secure password change when user risk = High, ensuring the account owner verifies identity through MFA before password writeback.

Conditional Access Administrator (or higher, such as Global Administrator) can create or edit user risk–based Conditional Access policies.

Yes. Always exclude emergency access accounts to prevent accidental lockout during incidents or outages.

Yes, Cayosoft Guardian Protector.

Yes, Cayosoft Guardian.

References

Final Thought

Proactive monitoring and timely remediation of configuration risks is essential to maintaining a secure Active Directory and Microsoft 365 environment. By addressing issues like Microsoft Entra tenant with unsecure configuration of user risk policy, you reduce attack surfaces and strengthen your organization’s overall security posture.

Tagged