introduction
previous article we have seen how to use conditiona laccess policies to enhance security in organization by force certain action based on specific condition
this article : we will see how to Force to change password with sign-in Risk
Risk Classfiication
Identity Protection identifies risks in the following classifications:
Atypical travel
- Sign in from an atypical location based on the user’s recent sign-ins.
Anonymous IP address
- Sign in from an anonymous IP address (for example: Tor browser, anonymizer VPNs).
Unfamiliar sign-in properties
- Sign in with properties we’ve not seen recently for the given user.
Malware linked IP address
- Sign in from a malware linked IP address.
Leaked Credentials
- Indicates that the user’s valid credentials have been leaked.
Password spray
- Indicates that multiple usernames are being attacked using common passwords in a unified, brute-force manner.
Azure AD threat intelligence
Microsoft’s internal and external threat intelligence sources have identified a known attack patter
Risk levels
Identity Protection categorizes risk into three tiers:
- low,
- medium,
- high.
While Microsoft does not provide specific details about how risk is calculated, >> we will say that each level brings higher confidence that the user or sign-in is compromised.
For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user.
company Requirements
to enhance security : Pioneers101 company need to require change password when sign-in risk
create policy to change password when sign-in risky
to create policy
open portal azure >> conditional access >> policies
Risk Report
once risk occurred : azure security will logg that risk
and could be checked in Azure security reports
open https://portal.azure.com
Conclusion
in conditional access policy there is NOthing to do with Risk user or risk sign-in
But ,,,,
in coming article with identity protection there is separate article to fully discuss risk users and risk sign-in
please keep tuned
