Forum Discussion

egrizzly365's avatar
egrizzly365
Copper Contributor
May 24, 2024

Segmentation For Risky User/Risky Sign In Policy

I started for a company that runs primarily on an Azure and Microsoft Defender environment.  They get tons and tons of alerts for Risky User activity.  Recently I looked at their Risky Users policy and found that it was set to Who All Users, Severity All Low, High, and Critical alerts, Mitigation Block/Lockout.  So basically, the company janitor with extremely limited access along with the CEO are all dumped into the same bucket.  For this reason they get tons of these alerts with the users triggering the alerts getting locked out.  The Risky User alerts/blocks is literally crippling their productivity.
 
 Is the best practice for this not to have users segmented and then assign different levels of the Risky User policy to them? How does one go about methodically and systematically setting up this segmentation?
 
The company is the type that is made up of multiple smaller companies added from acquisitions.
    • egrizzly365's avatar
      egrizzly365
      Copper Contributor

      Thanks MatejKlemencic. I meant how do you go about determining which groups will get segmented? Meaning, if there are 3 users James Dean, John Doe, and Jane Doe with different job roles how do you determine which job roles get put into a higher or lower risk segment?
      • MatejKlemencic's avatar
        MatejKlemencic
        Brass Contributor

        Hi egrizzly365 

        I don't use multiple policies for different groups. Instead, I configure two conditional access policies: one for risky sign-ins and another for risky users. In these policies, I block access if the risk level is medium or high. For low-risk levels, I only notify administrators and don't implement any blocking actions. Additionally, I set up an exclusion rule to prevent access from being blocked if a user connects from a trusted device (such as an Intune compliant device) or a trusted site. This approach helps avoid false positives from blocking legitimate sign-ins. Besides blocking, you can also choose different actions, such as requiring MFA or a password change.

Resources