EIDCA-012: Sign-In Risk-Based CA Policies
- Plataforma
- Entra ID / M365
- Categoría
- Entra ID Conditional Access
- Severidad
- High
- Pilar de Zero Trust
- Identity (peso 3)
- Fixtures de referencia
- 3
- Cobertura de ramas
- Observada: los fixtures prueban los veredictos que ejercitan
- Procedencia
- baseline
Qué comprueba
Sign-in risk-based Conditional Access policies use Azure AD Identity Protection signals to detect anomalous sign-in behavior such as impossible travel, anonymous IP usage, and credential leak detection. Without risk-based policies, compromised credentials can be used from suspicious locations or patterns without triggering additional verification.
Valor recomendado
CA policies configured to require MFA or block access for medium and high sign-in risk levels
Remediación
Create Conditional Access policies that target all users with the sign-in risk condition set to medium and high, requiring multifactor authentication as the grant control. Ensure Azure AD Identity Protection is enabled and properly licensed (requires Entra ID P2). Monitor the risky sign-ins report regularly and tune risk detection sensitivity based on organizational patterns.
Veredictos probados con fixtures
Cada veredicto de esta tabla está probado por un fixture de referencia en la suite de pruebas que valida el módulo. La tabla se deriva de la última ejecución en verde; no puede editarse a mano.
| Escenario | Veredicto esperado |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Mapeos a marcos de referencia
- CISA SCuBA
- MS.AAD.2.3v1
- NIST SP 800-53
- IA-2(13)
- CIS M365 Benchmark
- 5.2.2.7
- MITRE ATT&CK
- T1078.004, T1110