|
1 | 1 | --- |
2 | | -title: Azure AD Identity Protection policies |
3 | | -description: Identifying the three policies that are enabled with Identity Protection |
| 2 | +title: Azure AD Identity Protection risk-based access policies |
| 3 | +description: Identifying risk-based Conditional Access policies |
4 | 4 |
|
5 | 5 | services: active-directory |
6 | 6 | ms.service: active-directory |
7 | 7 | ms.subservice: identity-protection |
8 | 8 | ms.topic: conceptual |
9 | | -ms.date: 08/22/2022 |
| 9 | +ms.date: 10/04/2022 |
10 | 10 |
|
11 | 11 | ms.author: joflore |
12 | 12 | author: MicrosoftGuyJFlo |
13 | 13 | manager: amycolannino |
14 | | -ms.reviewer: sahandle |
| 14 | +ms.reviewer: chuqiaoshi |
15 | 15 |
|
16 | 16 | ms.collection: M365-identity-device-management |
17 | 17 | --- |
18 | | -# Identity Protection policies |
| 18 | +# Risk-based access policies |
19 | 19 |
|
20 | | -Azure Active Directory Identity Protection includes three default policies that administrators can choose to enable. These policies include limited customization but are applicable to most organizations. All of the policies allow for excluding users such as your [emergency access or break-glass administrator accounts](../roles/security-emergency-access.md). |
| 20 | +Access control policies can be applied to protect organizations when a sign-in or user is detected to be at risk. Such policies are called **risk-based policies**. |
21 | 21 |
|
22 | | - |
| 22 | +Azure AD Conditional Access offers two risk conditions: **Sign-in risk** and **User risk**. Organizations can create risk-based Conditional Access policies by configuring these two risk conditions and choosing an access control method. During each sign-in, Identity Protection sends the detected risk levels to Conditional Access, and the risk-based policies will apply if the policy conditions are satisfied. |
23 | 23 |
|
24 | | -## Azure AD MFA registration policy |
| 24 | + |
| 25 | + |
| 26 | +For example, as shown in the diagram below, if organizations have a sign-in risk policy that requires multifactor authentication when the sign-in risk level is medium or high, their users must complete multifactor authentication when their sign-in risk is medium or high. |
25 | 27 |
|
26 | | -Identity Protection can help organizations roll out Azure AD Multifactor Authentication (MFA) using a Conditional Access policy requiring registration at sign-in. Enabling this policy is a great way to ensure new users in your organization have registered for MFA on their first day. Multifactor authentication is one of the self-remediation methods for risk events within Identity Protection. Self-remediation allows your users to take action on their own to reduce helpdesk call volume. |
| 28 | + |
27 | 29 |
|
28 | | -More information about Azure AD Multifactor Authentication can be found in the article, [How it works: Azure AD Multifactor Authentication](../authentication/concept-mfa-howitworks.md). |
| 30 | +The example above also demonstrates a main benefit of a risk-based policy: **automatic risk remediation**. When a user successfully completes the required access control, like a secure password change, their risk is remediated. That sign-in session and user account won't be at risk, and no action is needed from the administrator. |
29 | 31 |
|
30 | | -## Sign-in risk policy |
| 32 | +Allowing users to self-remediate using this process will significantly reduce the risk investigation and remediation burden on the administrators while protecting your organizations from security compromises. More information about risk remediation can be found in the article, [Remediate risks and unblock users](howto-identity-protection-remediate-unblock.md). |
31 | 33 |
|
32 | | -Identity Protection analyzes signals from each sign-in, both real-time and offline, and calculates a risk score based on the probability that the sign-in wasn't really the user. Administrators can make a decision based on this risk score signal to enforce organizational requirements like: |
| 34 | +## Sign-in risk-based Conditional Access policy |
| 35 | + |
| 36 | +During each sign-in, Identity Protection analyzes hundreds of signals in real-time and calculates a sign-in risk level that represents the probability that the given authentication request isn't authorized. This risk level then gets sent to Conditional Access, where the organization's configured policies are evaluated. Administrators can configure sign-in risk-based Conditional Access policies to enforce access controls based on sign-in risk, including requirements such as: |
33 | 37 |
|
34 | 38 | - Block access |
35 | 39 | - Allow access |
36 | 40 | - Require multifactor authentication |
37 | 41 |
|
38 | | -If risk is detected, users can perform multifactor authentication to self-remediate and close the risky sign-in event to prevent unnecessary noise for administrators. |
39 | | - |
40 | | -> [!NOTE] |
41 | | -> Users must have previously registered for Azure AD Multifactor Authentication before triggering the sign-in risk policy. |
| 42 | +If risks are detected on a sign-in, users can perform the required access control such as multifactor authentication to self-remediate and close the risky sign-in event to prevent unnecessary noise for administrators. |
42 | 43 |
|
43 | | -### Custom Conditional Access policy |
| 44 | + |
44 | 45 |
|
45 | | -Administrators can also choose to create a custom Conditional Access policy including sign-in risk as an assignment condition. More information about risk as a condition in a Conditional Access policy can be found in the article, [Conditional Access: Conditions](../conditional-access/concept-conditional-access-conditions.md#sign-in-risk) |
| 46 | +> [!NOTE] |
| 47 | +> Users must have previously registered for Azure AD multifactor authentication before triggering the sign-in risk policy. |
46 | 48 |
|
47 | | - |
| 49 | +## User risk-based Conditional Access policy |
48 | 50 |
|
49 | | -## User risk policy |
| 51 | +Identity Protection analyzes signals about user accounts and calculates a risk score based on the probability that the user has been compromised. If a user has risky sign-in behavior, or their credentials have been leaked, Identity Protection will use these signals to calculate the user risk level. Administrators can configure user risk-based Conditional Access policies to enforce access controls based on user risk, including requirements such as: |
50 | 52 |
|
51 | | -Identity Protection can calculate what it believes is normal for a user's behavior and use that to base decisions for their risk. User risk is a calculation of probability that an identity has been compromised. Administrators can make a decision based on this risk score signal to enforce organizational requirements. Administrators can choose to block access, allow access, or allow access but require a password change using [Azure AD self-service password reset](../authentication/howto-sspr-deployment.md). |
| 53 | +- Block access |
| 54 | +- Allow access but require a secure password change using [Azure AD self-service password reset](../authentication/howto-sspr-deployment.md). |
52 | 55 |
|
53 | | -If risk is detected, users can perform self-service password reset to self-remediate and close the user risk event to prevent unnecessary noise for administrators. |
| 56 | +A secure password change will remediate the user risk and close the risky user event to prevent unnecessary noise for administrators. |
54 | 57 |
|
55 | 58 | > [!NOTE] |
56 | 59 | > Users must have previously registered for self-service password reset before triggering the user risk policy. |
57 | 60 |
|
| 61 | +## Identity Protection policies |
| 62 | + |
| 63 | +While Identity Protection also offers a user interface for creating user risk policy and sign-in risk policy, we highly recommend that you [use Azure AD Conditional Access to create risk-based policies](howto-identity-protection-configure-risk-policies.md) for the following benefits: |
| 64 | + |
| 65 | +- Rich set of conditions to control access: Conditional Access offers a rich set of conditions such as applications and locations for configuration. The risk conditions can be used in combination with other conditions to create policies that best enforce your organizational requirements. |
| 66 | +- Multiple risk-based policies can be put in place to target different user groups or apply different access control for different risk levels. |
| 67 | +- Conditional Access policies can be created through Microsoft Graph API and can be tested first in report-only mode. |
| 68 | +- Manage all access policies in one place in Conditional Access. |
| 69 | + |
| 70 | +If you already have Identity Protection risk policies set up, we encourage you to [migrate them to Conditional Access](howto-identity-protection-configure-risk-policies.md#migrate-risk-policies-from-identity-protection-to-conditional-access). |
| 71 | + |
| 72 | +## Azure AD MFA registration policy |
| 73 | + |
| 74 | +Identity Protection can help organizations roll out Azure AD multifactor authentication (MFA) using a policy requiring registration at sign-in. Enabling this policy is a great way to ensure new users in your organization have registered for MFA on their first day. Multifactor authentication is one of the self-remediation methods for risk events within Identity Protection. Self-remediation allows your users to take action on their own to reduce helpdesk call volume. |
| 75 | + |
| 76 | +More information about Azure AD multifactor authentication can be found in the article, [How it works: Azure AD multifactor authentication](../authentication/concept-mfa-howitworks.md). |
| 77 | + |
58 | 78 | ## Next steps |
59 | 79 |
|
60 | 80 | - [Enable Azure AD self-service password reset](../authentication/howto-sspr-deployment.md) |
61 | | -- [Enable Azure AD Multifactor Authentication](../authentication/howto-mfa-getstarted.md) |
62 | | -- [Enable Azure AD Multifactor Authentication registration policy](howto-identity-protection-configure-mfa-policy.md) |
| 81 | +- [Enable Azure AD multifactor authentication](../authentication/howto-mfa-getstarted.md) |
| 82 | +- [Enable Azure AD multifactor authentication registration policy](howto-identity-protection-configure-mfa-policy.md) |
63 | 83 | - [Enable sign-in and user risk policies](howto-identity-protection-configure-risk-policies.md) |
0 commit comments