Control: 5.2.2.6 Enable Identity Protection user risk policies

Description

Microsoft Entra ID Protection user risk policies detect the probability that a user account has been compromised.

Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the "legacy method" for the following benefits:

Enhanced diagnostic data
Report-only mode integration
Graph API support
Use more Conditional Access attributes like sign-in frequency in the policy

Remediation

To remediate using the UI:

Navigate to Microsoft Entra admin center https://entra.microsoft.com/.
Click to expand Protection > Conditional Access select Policies.
Create a new policy by selecting New policy.
Set the following conditions within the policy:
- Under Users choose All users.
- Under Target resources choose All resources (formerly 'All cloud apps').
- Under Conditions choose User risk then Yes and select the user risk level High.
- Under Grant select Grant access then check Require multifactor authentication or Require authentication strength. Finally check Require password change.
- Under Session set Sign-in frequency to Every time.
- Click Select.
Under Enable policy set it to Report-only until the organization is ready to enable it.
Click Create or Save.

Note: Break-glass accounts should be excluded from all Conditional Access policies.

Usage

Run the control in your terminal:

powerpipe control run microsoft365_compliance.control.cis_v500_5_2_2_6

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run microsoft365_compliance.control.cis_v500_5_2_2_6 --share

SQL

This control uses a named query:

with block_legacy_authentication as (
  select
    tenant_id,
    count(*)
  from
    azuread_conditional_access_policy
  where
    users->'includeUsers' ?& array['All']
    and jsonb_array_length(users -> 'excludeUsers') = 0
    and jsonb_array_length(user_risk_levels) != 0
    and applications->'includeApplications' ?& array['All']
    and jsonb_array_length(applications -> 'excludeApplications') = 0
    and built_in_controls ?& array['passwordChange']
  group by
    tenant_id
),
tenant_list as (
  select
    distinct on (tenant_id) tenant_id,
    _ctx
  from
    azuread_user
)
select
  t.tenant_id as resource,
  case
    when (select count from block_legacy_authentication where tenant_id = t.tenant_id) > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when (select count from block_legacy_authentication where tenant_id = t.tenant_id) > 0 then t.tenant_id || ' has user risk policies enabled.'
    else t.tenant_id || ' has user risk policies disabled.'
  end as reason
  , t.tenant_id as tenant_id
from
  tenant_list as t;

Control: 5.2.2.6 Enable Identity Protection user risk policies

Description

Remediation

Usage

SQL

Tags