Exercise enable sign-in risk policy

Completed

Exercise Environment needs - This lab assumes you have access to a Microsoft Entra tenant with basic admin rights to complete. If you want to set up a trail environment, Try Azure for Free.

Enable user risk policy

1. Sign in to the Microsoft Entra admin center using a Global administrator account.

2. Open the portal menu and then select Identity.

3. On the Identity menu, select Protection.

4. On the Security page, in the left navigation, select Identity protection.

5. On the Identity protection page, in the left navigation, select User risk policy.

   

6. Under Assignments, select All users and review the available options. You can select from All users or Select individuals and groups if limiting your rollout. Additionally, you can choose to exclude users from the policy.

7. Under User risk, select Low and above.

8. In the User risk pane, select High and then select Done.

9. Under Controls, look within the Access section, and select the Block access to open the Access dialog.

10. In the Access pane, review the available options.

Tip

Microsoft's recommendation is to Allow access and Require password change.

11. Select the Require password change check box and then select Done.
12. Under Enforce Policy, select On and then select Save.

Enable sign-in risk policy

1. On the Identity protection blade, in the left navigation, select Sign-in risk policy.
2. As with the User risk policy, the Sign-in risk policy can be assigned to users and groups and allows you to exclude users from the policy.
3. Under Sign-in risk, select Medium and above.
4. In the Sign-in risk pane, select High and then select Done.
5. Within the Controls section, find the Access, and then select words Block access to open the Access dialog.
6. Select the Require multifactor authentication check box and then select Done.
7. Under Enforce Policy, select On and then select Save.