Segmentation For Risky User/Risky Sign In Policy

Question

I started for a company that runs primarily on an Azure and Microsoft Defender environment.&nbsp; They get tons and tons of alerts for Risky User activity.&nbsp; Recently I looked at their Risky Users policy and found that it was set to&nbsp;Who&nbsp;All Users,&nbsp;Severity&nbsp;All Low, High, and Critical alerts,&nbsp;Mitigation&nbsp;Block/Lockout.&nbsp; So basically, the company janitor with extremely limited access along with the CEO are all dumped into the same bucket.&nbsp; For this reason they get tons of these alerts with the users triggering the alerts getting locked out.&nbsp; The Risky User alerts/blocks is literally crippling their productivity.&nbsp;&nbsp;Is the best practice for this not to have users segmented and then assign different levels of the Risky User policy to them? How does one go about methodically and systematically setting up this segmentation?&nbsp;The company is the type that is made up of multiple smaller companies added from acquisitions.

matejklemencic · Answer

Hello&nbsp;egrizzly365&nbsp;To apply different Risks policies to various user groups (scopes), you should manage them with Conditional Access Policies.&nbsp;By doing this, you can tailor controls for users based on their roles within the company and manage exclusions more effectively.&nbsp;Check this article&nbsp;Risk policies - Microsoft Entra ID Protection | Microsoft Learn&nbsp;

egrizzly365 · Answer

Thanks MatejKlemencic. I meant how do you go about determining which groups will get segmented? Meaning, if there are 3 users James Dean, John Doe, and Jane Doe with different job roles how do you determine which job roles get put into a higher or lower risk segment?

matejklemencic · Answer

Hi&nbsp;egrizzly365&nbsp;I don't use multiple policies for different groups. Instead, I configure two conditional access policies: one for risky sign-ins and another for risky users. In these policies, I block access if the risk level is medium or high. For low-risk levels, I only notify administrators and don't implement any blocking actions. Additionally, I set up an exclusion rule to prevent access from being blocked if a user connects from a trusted device (such as an Intune compliant device) or a trusted site. This approach helps avoid false positives from blocking legitimate sign-ins. Besides blocking, you can also choose different actions, such as requiring MFA or a password change.

egrizzly365 · Answer

Thanks gotcha. So I take it you don't get the insane barrage of Blocked users who were flagged by the Risky User/Sign-in policies then?

matejklemencic · Answer

egrizzly365&nbsp;Correct.&nbsp;I've done multiple deployments without experiencing significant issues.

Forum Discussion

Segmentation For Risky User/Risky Sign In Policy

Share

Resources