Guidance Needed on Transitioning from Risk-Based Policies to Conditional Access in Microsoft Entra ID

Question

Under Identity Protection, we currently rely on:

• User Risk Policy
• Sign-in Risk Policy

These policies have been instrumental in protecting our users and detecting suspicious activity. However, as you know, both are now read-only and will be deprecated in October 2026.

We also have a Conditional Access policy in place to block sign-ins from overseas IP addresses.

Microsoft’s guidance recommends migrating risk-based protections to Conditional Access policies. To ensure we maintain an equivalent (or stronger) level of security, could you please advise on:

1. Best practices for replacing User/Sign-in Risk Policies using Conditional Access (e.g., leveraging risk levels as signals in CA policies, enabling risk-based Conditional Access)?
2. Our current policy disables user-initiated password changes for security reasons. Is this still considered a best practice—or should we re-enable it (e.g., with MFA and SSPR safeguards)?
3. Preventing VPN abuse: Is there a way to detect or block users from bypassing geo-restrictions by using local IP addresses via VPNs (e.g., using named locations with trusted IPs, sign-in risk detection, device compliance + Conditional Access, or Microsoft Defender for Identity)?
4. Session hijacking protection: Does Microsoft Entra ID offer built-in protections (e.g., token replay detection, session binding, continuous access evaluation, or integration with Microsoft Defender for Cloud Apps)?

Any actionable recommendations or reference documentation would be greatly appreciated.

Answer 1

To transition from User Risk and Sign-in Risk Policies in Microsoft Entra ID to Conditional Access (CA) policies while maintaining or enhancing security, consider the following best practices and recommendations:

1. Replacing User/Sign-in Risk Policies:
   • Create equivalent User Risk and Sign-in Risk policies in Conditional Access. Utilize risk levels as signals to enforce actions such as requiring multifactor authentication (MFA) or blocking access for high-risk sign-ins. This can enhance your security posture by allowing you to tailor responses based on the assessed risk level.
   • Enable risk-based Conditional Access policies to ensure that users are prompted for additional verification when a sign-in risk is detected.
2. User-Initiated Password Changes:
   • While disabling user-initiated password changes can enhance security, consider re-enabling this feature with appropriate safeguards like MFA and Self-Service Password Reset (SSPR). This allows users to remediate risks themselves while maintaining security controls.
3. Preventing VPN Abuse:
   • To detect or block users bypassing geo-restrictions via VPNs, leverage named locations in Conditional Access to define trusted IPs. Implement sign-in risk detection and device compliance checks. Additionally, consider integrating with Microsoft Defender for Identity to monitor suspicious activities that may indicate VPN abuse.
4. Session Hijacking Protection:
   • Microsoft Entra ID provides built-in protections against session hijacking, including token replay detection and continuous access evaluation. You can also utilize session binding features to ensure that sessions remain secure and are tied to specific devices or locations.

For detailed guidance on configuring these policies, refer to the Microsoft documentation on Conditional Access and identity protection.

---

References:

• Risk-based access policies
• Configure and enable risk policies
• Microsoft Entra ID Protection scenario: Real-time risk detection for protected resources