You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/active-directory/authentication/howto-mfa-getstarted.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -103,8 +103,8 @@ If your organization uses [Azure AD Identity Protection](../identity-protection/
103
103
Risk policies include:
104
104
105
105
-[Require all users to register for Azure AD Multi-Factor Authentication](../identity-protection/howto-identity-protection-configure-mfa-policy.md)
106
-
-[Require a password change for users that are high-risk](../identity-protection/howto-identity-protection-configure-risk-policies.md#user-risk-with-conditional-access)
107
-
-[Require MFA for users with medium or high sign in risk](../identity-protection/howto-identity-protection-configure-risk-policies.md#sign-in-risk-with-conditional-access)
106
+
-[Require a password change for users that are high-risk](../identity-protection/howto-identity-protection-configure-risk-policies.md#user-risk-policy-in-conditional-access)
107
+
-[Require MFA for users with medium or high sign in risk](../identity-protection/howto-identity-protection-configure-risk-policies.md#sign-in-risk-policy-in-conditional-access)
108
108
109
109
### Convert users from per-user MFA to Conditional Access based MFA
Copy file name to clipboardExpand all lines: articles/active-directory/identity-protection/concept-identity-protection-risks.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.date: 08/16/2022
11
11
ms.author: joflore
12
12
author: MicrosoftGuyJFlo
13
13
manager: amycolannino
14
-
ms.reviewer: sahandle, chuqiaoshi
14
+
ms.reviewer: chuqiaoshi
15
15
16
16
ms.collection: M365-identity-device-management
17
17
---
@@ -99,7 +99,7 @@ Premium detections are visible only to Azure AD Premium P2 customers. Customers
99
99
100
100
### Risk levels
101
101
102
-
Identity Protection categorizes risk into three tiers: low, medium, and high. When configuring [custom Identity protection policies](./concept-identity-protection-policies.md#custom-conditional-access-policy), you can also configure it to trigger upon **No risk** level. No Risk means there's no active indication that the user's identity has been compromised.
102
+
Identity Protection categorizes risk into three tiers: low, medium, and high. When configuring [Identity protection policies](./concept-identity-protection-policies.md), you can also configure it to trigger upon **No risk** level. No Risk means there's no active indication that the user's identity has been compromised.
103
103
104
104
Microsoft doesn't provide specific details about how risk is calculated. Each level of risk brings higher confidence that the user or sign-in is compromised. For example, something like one instance of unfamiliar sign-in properties for a user might not be as threatening as leaked credentials for another user.
Copy file name to clipboardExpand all lines: articles/active-directory/identity-protection/howto-identity-protection-configure-risk-policies.md
+8-8Lines changed: 8 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -86,7 +86,7 @@ Before organizations enable remediation policies, they may want to [investigate]
86
86
1. Confirm your settings and set **Enable policy** to **Report-only**.
87
87
1. Select **Create** to create to enable your policy.
88
88
89
-
After confirming your settings using [report-only mode](howto-conditional-access-insights-reporting.md), an administrator can move the **Enable policy** toggle from **Report-only** to **On**.
89
+
After confirming your settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), an administrator can move the **Enable policy** toggle from **Report-only** to **On**.
90
90
91
91
### Sign-in risk policy in Conditional Access
92
92
@@ -112,7 +112,7 @@ After confirming your settings using [report-only mode](howto-conditional-access
112
112
1. Confirm your settings and set **Enable policy** to **Report-only**.
113
113
1. Select **Create** to create to enable your policy.
114
114
115
-
After confirming your settings using [report-only mode](howto-conditional-access-insights-reporting.md), an administrator can move the **Enable policy** toggle from **Report-only** to **On**.
115
+
After confirming your settings using [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md), an administrator can move the **Enable policy** toggle from **Report-only** to **On**.
116
116
117
117
## Migrate risk policies from Identity Protection to Conditional Access
118
118
@@ -128,14 +128,14 @@ If you already have risk policies enabled in Identity Protection, we highly reco
128
128
129
129
130
130
1. Create an equivalent risk policy in [Conditional Access in report-only mode](#enable-policies).
131
-
1. Ensure that the new Conditional Access risk policy works as expected by testing it in [report-only mode](howto-conditional-access-insights-reporting.md).
131
+
1. Ensure that the new Conditional Access risk policy works as expected by testing it in [report-only mode](../conditional-access/howto-conditional-access-insights-reporting.md).
132
132
1. Enable the new Conditional Access risk policy. You can choose to have both policies running side-by-side to confirm the new policies are working as expected before turning off the Identity Protection risk policies.
133
-
1. Browse back to **Azure Active Directory** > **Security** > **Conditional Access**.
134
-
1. Select this new policy to edit it.
135
-
1. Set **Enable policy** to **On** to enable the policy
133
+
1. Browse back to **Azure Active Directory** > **Security** > **Conditional Access**.
134
+
1. Select this new policy to edit it.
135
+
1. Set **Enable policy** to **On** to enable the policy
136
136
1. Disable the old risk policies in Identity Protection.
137
-
1. Browse to **Azure Active Directory** > **Identity Protection** > Select the **User risk** or **Sign-in risk** policy.
138
-
1. Set **Enforce policy** to **Off**
137
+
1. Browse to **Azure Active Directory** > **Identity Protection** > Select the **User risk** or **Sign-in risk** policy.
138
+
1. Set **Enforce policy** to **Off**
139
139
1. Create other risk policies if needed in Conditional Access.
Copy file name to clipboardExpand all lines: articles/active-directory/reports-monitoring/workbook-risk-analysis.md
+4-35Lines changed: 4 additions & 35 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,94 +14,63 @@ ms.workload: identity
14
14
ms.subservice: report-monitor
15
15
ms.date: 08/26/2022
16
16
ms.author: markvi
17
-
ms.reviewer: sahandle
17
+
ms.reviewer: chuqiaoshi
18
18
19
19
ms.collection: M365-identity-device-management
20
20
---
21
-
22
21
# Identity protection risk analysis workbook
23
22
24
23
Azure AD Identity Protection detects, remediates, and prevents compromised identities. As an IT administrator, you want to understand risk trends in your organizations and opportunities for better policy configuration. With the Identity Protection Risky Analysis Workbook, you can answer common questions about your Identity Protection implementation.
25
24
26
25
This article provides you with an overview of this workbook.
As an IT administrator, you need to understand trends in identity risks and gaps in your policy implementations to ensure you are best protecting your organizations from identity compromise. The identity protection risk analysis workbook helps you analyze the state of risk in your organization.
31
+
As an IT administrator, you need to understand trends in identity risks and gaps in your policy implementations, to ensure you're best protecting your organizations from identity compromise. The identity protection risk analysis workbook helps you analyze the state of risk in your organization.
35
32
36
33
**This workbook:**
37
34
38
35
- Provides visualizations of where in the world risk is being detected.
39
-
40
36
- Allows you to understand the trends in real time vs. Offline risk detections.
41
-
42
37
- Provides insight into how effective you are at responding to risky users.
43
38
44
-
45
-
46
-
47
-
48
39
## Sections
49
40
50
41
This workbook has five sections:
51
42
52
43
- Heatmap of risk detections
53
-
54
44
- Offline vs real-time risk detections
55
-
56
45
- Risk detection trends
57
-
58
46
- Risky users
59
-
60
47
- Summary
61
48
62
-
63
-
64
-
65
-
66
-
67
-
68
49
## Filters
69
50
70
-
71
51
This workbook supports setting a time range filter.
72
52
73
-
74
53
75
54
76
55
There are more filters in the risk detection trends and risky users sections.
77
56
78
57
Risk Detection Trends:
79
58
80
59
- Detection timing type (real-time or offline)
81
-
82
60
- Risk level (low, medium, high, or none)
83
61
84
62
Risky Users:
85
63
86
64
- Risk detail (which indicates what changed a user’s risk level)
87
-
88
65
- Risk level (low, medium, high, or none)
89
66
90
-
91
67
## Best practices
92
68
69
+
-**[Enable risky sign-in policies](../identity-protection/concept-identity-protection-policies.md#sign-in-risk-based-conditional-access-policy)** - To prompt for multi-factor authentication (MFA) on medium risk or above. Enabling the policy reduces the proportion of active real-time risk detections by allowing legitimate users to self-remediate the risk detections with MFA.
93
70
94
-
-**[Enable risky sign-in policies](../identity-protection/concept-identity-protection-policies.md)** - To prompt for multi-factor authentication (MFA) on medium risk or above. Enabling the policy reduces the proportion of active real-time risk detections by allowing legitimate users to self-remediate the risk detections with MFA.
95
-
96
-
-**[Enable a risky user policy](../identity-protection/howto-identity-protection-configure-risk-policies.md#user-risk-with-conditional-access)** - To enable users to securely remediate their accounts when they are high risk. Enabling the policy reduces the number of active at-risk users in your organization by returning the user’s credentials to a safe state.
97
-
98
-
99
-
100
-
71
+
-**[Enable a risky user policy](../identity-protection/howto-identity-protection-configure-risk-policies.md#user-risk-policy-in-conditional-access)** - To enable users to securely remediate their accounts when they're high risk. Enabling the policy reduces the number of active at-risk users in your organization by returning the user’s credentials to a safe state.
101
72
102
73
## Next steps
103
74
104
75
- To learn more about identity protection, see [What is identity protection](../identity-protection/overview-identity-protection.md).
105
-
106
76
- For more information about Azure AD workbooks, see [How to use Azure AD workbooks](howto-use-azure-monitor-workbooks.md).
0 commit comments