Day-12: Risk-Based Conditional Access in Microsoft 365
🎯 Objective of Day-12
By the end of Day-12, you will be able to:
- Explain risk concepts clearly
- Design risk-based CA policies
- Understand automatic access blocking
- Respond confidently to security incidents
1️⃣ What Is Risk in Microsoft 365?
Risk is a probability that an identity or device is compromised.
Microsoft calculates risk using:
- Sign-in behavior
- Device health
- Threat intelligence
- User activity patterns
2️⃣ Types of Risk (Very Important)
🔹 Sign-In Risk
Evaluates a specific login attempt.
Examples:
- Impossible travel
- Anonymous IP
- Suspicious login behavior
🔹 User Risk
Evaluates overall user account compromise.
Examples:
- Credentials leaked
- Malware activity
- Password spray detection
🔹 Device Risk
Evaluates endpoint security posture.
Source:
- Microsoft Defender for Endpoint
Examples:
- Malware detected
- Exploit behavior
- Outdated security state
3️⃣ Where Risk Comes From
| Risk Type | Source |
|---|---|
| Sign-in risk | Entra ID Identity Protection |
| User risk | Entra ID + Microsoft threat intel |
| Device risk | Defender for Endpoint |
📌 Conditional Access consumes these signals — it does not calculate them.
4️⃣ Risk-Based Conditional Access Concept
Flow:
User attempts sign-in
↓
Risk evaluated (user / sign-in / device)
↓
Conditional Access policy triggered
↓
Access allowed, challenged, or blocked
5️⃣ Common Risk-Based CA Policies
🔹 Require MFA for Medium Risk
- Protects against stolen credentials
🔹 Block High-Risk Sign-Ins
- Prevents account takeover
🔹 Block High-Risk Devices
- Stops malware-infected endpoints
6️⃣ Creating a Risk-Based CA Policy (Example)
Scenario: Block high sign-in risk
Steps:
- Entra Admin Center → Conditional Access
- Create new policy
- Users → Select users (exclude break-glass)
- Conditions → Sign-in risk → High
- Grant → Block access
- Enable in Report-only first
7️⃣ Report-Only Mode (Again — Critical)
Always validate:
- Who would be blocked?
- Which apps affected?
- False positives?
📌 Risk-based CA without testing = outages.
8️⃣ How Device Risk Works with CA
Device infected → Defender reports High risk
↓
Intune syncs status
↓
CA evaluates device risk
↓
Access blocked automatically
📌 No admin action required.
9️⃣ Real-World Scenario
Incident:
User laptop infected with malware.
What happens automatically:
- Defender flags device as High risk
- CA blocks M365 access
- SOC/admin remediates device
- Risk reduced
- Access restored
✔ Fast
✔ Automated
✔ Secure
🔟 Common Admin Mistakes
❌ No Identity Protection enabled
❌ No break-glass account
❌ Applying block policies tenant-wide
❌ Ignoring report-only results
1️⃣1️⃣ Best Practices Checklist
✔ Enable Identity Protection
✔ Use report-only first
✔ Exclude emergency accounts
✔ Monitor sign-in logs daily
✔ Document incident workflows
1️⃣2️⃣ Zero Trust Alignment
Risk-based CA supports:
- Verify explicitly
- Assume breach
- Adaptive access control
📌 This is Zero Trust in action, not theory.
✅ End of Day-12 Outcome
You can now:
✔ Explain risk-based access clearly
✔ Design adaptive CA policies
✔ Respond to security incidents confidently
✔ Connect Defender, Intune & Entra ID
🔜 Day-13 Preview
Day-13: Incident Response in Microsoft 365
- Investigating sign-in incidents
- Using logs effectively
- Containment & recovery steps
- Admin + SOC collaboration