CISA.MS.AAD.2.2: A notification SHOULD be sent to the administrator when high-risk users are detected.
| ID | CISA.MS.AAD.2.2 |
| Severity | Medium |
| Suite | CISA SCuBA baselines |
| Product | Entra ID |
| Feature | Identity Protection |
| Security area | Logging and detection |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.2.2 (SHOULD) |
| Framework controls | cisa-scuba:MS.AAD.2.2nist-800-53-r5:AC-2(12) Account Management | Account Monitoring for Atypical Usage |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM_P2 |
What this checks and how to fix it
Section titled “What this checks and how to fix it”A notification SHOULD be sent to the administrator when high-risk users are detected.
Rationale: Notification enables the admin to monitor the event and remediate the risk. This helps the organization proactively respond to cyber intrusions as they occur.
Remediation action:
Section titled “Remediation action:”Follow the guide below to configure Entra ID Protection to send a regularly monitored security mailbox email notification when user accounts are determined to be high risk.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.