CISA.MS.AAD.2.3: Sign-ins detected as high risk SHALL be blocked.
| ID | CISA.MS.AAD.2.3 |
| Severity | High |
| Suite | CISA SCuBA baselines |
| Product | Entra ID |
| Feature | Conditional Access |
| Security area | Access control |
| Resource type | Tenant |
| User impact of fixing | Low |
| Effort to fix | Low |
| Benchmark | CISA SCuBA Secure Configuration Baselines for Microsoft 365 ScubaGear main, 2026-10-11, MS.AAD.2.3 (SHALL) |
| Framework controls | cisa-scuba:MS.AAD.2.3nist-800-53-r5:AC-2(12) Account Management | Account Monitoring for Atypical Usagenist-800-53-r5:AC-2(13) Account Management | Disable Accounts for High-risk Individuals |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
| Licence needed | AAD_PREMIUM_P2 |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Sign-ins detected as high risk SHALL be blocked.
Rationale: Blocking high-risk sign-ins may prevent compromised accounts from accessing the tenant.
Remediation action:
Section titled “Remediation action:”Create a Conditional Access policy blocking sign-ins determined to be high risk by Microsoft Entra ID Protection. Configure the following policy settings in the new Conditional Access policy as per the values below:
- Users > Include > All users
- Target resources > Cloud apps > All cloud apps
- Conditions > Sign-in risk > High
- Access controls > Grant > Block Access
Note: While CISA recommends blocking, the Microsoft recommendation is to require multi-factor authentication for high-risk sign-ins.
Related links
Section titled “Related links”Mito check, based on CISA ScubaGear. Author: soulemike; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.